Migrate credential-library nomenclature around targets to credential-source (#1413)

See the CHANGELOG entry for more information.

Co-authored-by: Jim <jlambert@hashicorp.com>

Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>

CHANGELOG.md

@@ -4,6 +4,25 @@ Canonical reference for changes, improvements, and bugfixes for Boundary.
 
 ## Next
 
+### Deprecations/Changes
+
+* With respect to Target resources, _credential libraries_ that are attached to
+  the targets are being renamed to the more abstract _credential sources_. In
+  the future Boundary will gain the ability to internally store static
+  credentials that are not generated or fetched dynamically, and the _sources_
+  terminology better reflects that the IDs provided are a source of credentials,
+  whether via dynamic generation or via the credentials themselves. This will
+  allow a paradigm similar to `principals` with roles, where the principal IDs
+  can be a users, groups, and managed groups, rather than having them split out,
+  and should result in an easier user experience once those features roll out
+  compared to having separate flags and fields. In this 0.5 release the Boundary
+  CLI has gained parallel `application-credential-source` flags to the existing
+  `application-credential-library` flags, as well as `boundary targets
+  add/remove/set-credential-sources` commands that parallel `boundary targets
+  add/remove/set-credential-libraries` commands. This parallelism extends to the
+  API actions and the grants system. In 0.6, the _library_ versions of these
+  commands, flags, and actions will be removed.
+
 ### New and Improved
 
 * OIDC Accounts: When performing a `read` on an `oidc` type account, the

api/targets/credential_source.gen.go

@@ -0,0 +1,10 @@
+// Code generated by "make api"; DO NOT EDIT.
+package targets
+
+type CredentialSource struct {
+	Id                string `json:"id,omitempty"`
+	Name              string `json:"name,omitempty"`
+	Description       string `json:"description,omitempty"`
+	CredentialStoreId string `json:"credential_store_id,omitempty"`
+	Type              string `json:"type,omitempty"`
+}

api/targets/option.gen.go

@@ -99,6 +99,18 @@ func DefaultApplicationCredentialLibraryIds() Option {
 	}
 }
 
+func WithApplicationCredentialSourceIds(inApplicationCredentialSourceIds []string) Option {
+	return func(o *options) {
+		o.postMap["application_credential_source_ids"] = inApplicationCredentialSourceIds
+	}
+}
+
+func DefaultApplicationCredentialSourceIds() Option {
+	return func(o *options) {
+		o.postMap["application_credential_source_ids"] = nil
+	}
+}
+
 func WithAttributes(inAttributes map[string]interface{}) Option {
 	return func(o *options) {
 		o.postMap["attributes"] = inAttributes

api/targets/session_credential.gen.go

@@ -2,6 +2,7 @@
 package targets
 
 type SessionCredential struct {
+	CredentialSource  *CredentialSource  `json:"credential_source,omitempty"`
 	CredentialLibrary *CredentialLibrary `json:"credential_library,omitempty"`
 	Secret            *SessionSecret     `json:"secret,omitempty"`
 }

api/targets/target.gen.go

@@ -29,6 +29,8 @@ type Target struct {
 	WorkerFilter                    string                 `json:"worker_filter,omitempty"`
 	ApplicationCredentialLibraryIds []string               `json:"application_credential_library_ids,omitempty"`
 	ApplicationCredentialLibraries  []*CredentialLibrary   `json:"application_credential_libraries,omitempty"`
+	ApplicationCredentialSourceIds  []string               `json:"application_credential_source_ids,omitempty"`
+	ApplicationCredentialSources    []*CredentialSource    `json:"application_credential_sources,omitempty"`
 	Attributes                      map[string]interface{} `json:"attributes,omitempty"`
 	AuthorizedActions               []string               `json:"authorized_actions,omitempty"`
 
@@ -397,6 +399,70 @@ func (c *Client) AddCredentialLibraries(ctx context.Context, id string, version
 	return target, nil
 }
 
+func (c *Client) AddCredentialSources(ctx context.Context, id string, version uint32, opt ...Option) (*TargetUpdateResult, error) {
+	if id == "" {
+		return nil, fmt.Errorf("empty id value passed into AddCredentialSources request")
+	}
+
+	if c.client == nil {
+		return nil, errors.New("nil client")
+	}
+
+	opts, apiOpts := getOpts(opt...)
+
+	if version == 0 {
+		if !opts.withAutomaticVersioning {
+			return nil, errors.New("zero version number passed into AddCredentialSources request")
+		}
+		existingTarget, existingErr := c.Read(ctx, id, append([]Option{WithSkipCurlOutput(true)}, opt...)...)
+		if existingErr != nil {
+			if api.AsServerError(existingErr) != nil {
+				return nil, fmt.Errorf("error from controller when performing initial check-and-set read: %w", existingErr)
+			}
+			return nil, fmt.Errorf("error performing initial check-and-set read: %w", existingErr)
+		}
+		if existingTarget == nil {
+			return nil, errors.New("nil resource response found when performing initial check-and-set read")
+		}
+		if existingTarget.Item == nil {
+			return nil, errors.New("nil resource found when performing initial check-and-set read")
+		}
+		version = existingTarget.Item.Version
+	}
+
+	opts.postMap["version"] = version
+
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:add-credential-sources", id), opts.postMap, apiOpts...)
+	if err != nil {
+		return nil, fmt.Errorf("error creating AddCredentialSources request: %w", err)
+	}
+
+	if len(opts.queryMap) > 0 {
+		q := url.Values{}
+		for k, v := range opts.queryMap {
+			q.Add(k, v)
+		}
+		req.URL.RawQuery = q.Encode()
+	}
+
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("error performing client request during AddCredentialSources call: %w", err)
+	}
+
+	target := new(TargetUpdateResult)
+	target.Item = new(Target)
+	apiErr, err := resp.Decode(target.Item)
+	if err != nil {
+		return nil, fmt.Errorf("error decoding AddCredentialSources response: %w", err)
+	}
+	if apiErr != nil {
+		return nil, apiErr
+	}
+	target.response = resp
+	return target, nil
+}
+
 func (c *Client) AddHostSets(ctx context.Context, id string, version uint32, hostSetIds []string, opt ...Option) (*TargetUpdateResult, error) {
 	if id == "" {
 		return nil, fmt.Errorf("empty id value passed into AddHostSets request")
@@ -531,6 +597,70 @@ func (c *Client) SetCredentialLibraries(ctx context.Context, id string, version
 	return target, nil
 }
 
+func (c *Client) SetCredentialSources(ctx context.Context, id string, version uint32, opt ...Option) (*TargetUpdateResult, error) {
+	if id == "" {
+		return nil, fmt.Errorf("empty id value passed into SetCredentialSources request")
+	}
+
+	if c.client == nil {
+		return nil, errors.New("nil client")
+	}
+
+	opts, apiOpts := getOpts(opt...)
+
+	if version == 0 {
+		if !opts.withAutomaticVersioning {
+			return nil, errors.New("zero version number passed into SetCredentialSources request")
+		}
+		existingTarget, existingErr := c.Read(ctx, id, append([]Option{WithSkipCurlOutput(true)}, opt...)...)
+		if existingErr != nil {
+			if api.AsServerError(existingErr) != nil {
+				return nil, fmt.Errorf("error from controller when performing initial check-and-set read: %w", existingErr)
+			}
+			return nil, fmt.Errorf("error performing initial check-and-set read: %w", existingErr)
+		}
+		if existingTarget == nil {
+			return nil, errors.New("nil resource response found when performing initial check-and-set read")
+		}
+		if existingTarget.Item == nil {
+			return nil, errors.New("nil resource found when performing initial check-and-set read")
+		}
+		version = existingTarget.Item.Version
+	}
+
+	opts.postMap["version"] = version
+
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:set-credential-sources", id), opts.postMap, apiOpts...)
+	if err != nil {
+		return nil, fmt.Errorf("error creating SetCredentialSources request: %w", err)
+	}
+
+	if len(opts.queryMap) > 0 {
+		q := url.Values{}
+		for k, v := range opts.queryMap {
+			q.Add(k, v)
+		}
+		req.URL.RawQuery = q.Encode()
+	}
+
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("error performing client request during SetCredentialSources call: %w", err)
+	}
+
+	target := new(TargetUpdateResult)
+	target.Item = new(Target)
+	apiErr, err := resp.Decode(target.Item)
+	if err != nil {
+		return nil, fmt.Errorf("error decoding SetCredentialSources response: %w", err)
+	}
+	if apiErr != nil {
+		return nil, apiErr
+	}
+	target.response = resp
+	return target, nil
+}
+
 func (c *Client) SetHostSets(ctx context.Context, id string, version uint32, hostSetIds []string, opt ...Option) (*TargetUpdateResult, error) {
 	if id == "" {
 		return nil, fmt.Errorf("empty id value passed into SetHostSets request")
@@ -661,6 +791,70 @@ func (c *Client) RemoveCredentialLibraries(ctx context.Context, id string, versi
 	return target, nil
 }
 
+func (c *Client) RemoveCredentialSources(ctx context.Context, id string, version uint32, opt ...Option) (*TargetUpdateResult, error) {
+	if id == "" {
+		return nil, fmt.Errorf("empty id value passed into RemoveCredentialSources request")
+	}
+
+	if c.client == nil {
+		return nil, errors.New("nil client")
+	}
+
+	opts, apiOpts := getOpts(opt...)
+
+	if version == 0 {
+		if !opts.withAutomaticVersioning {
+			return nil, errors.New("zero version number passed into RemoveCredentialSources request")
+		}
+		existingTarget, existingErr := c.Read(ctx, id, append([]Option{WithSkipCurlOutput(true)}, opt...)...)
+		if existingErr != nil {
+			if api.AsServerError(existingErr) != nil {
+				return nil, fmt.Errorf("error from controller when performing initial check-and-set read: %w", existingErr)
+			}
+			return nil, fmt.Errorf("error performing initial check-and-set read: %w", existingErr)
+		}
+		if existingTarget == nil {
+			return nil, errors.New("nil resource response found when performing initial check-and-set read")
+		}
+		if existingTarget.Item == nil {
+			return nil, errors.New("nil resource found when performing initial check-and-set read")
+		}
+		version = existingTarget.Item.Version
+	}
+
+	opts.postMap["version"] = version
+
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:remove-credential-sources", id), opts.postMap, apiOpts...)
+	if err != nil {
+		return nil, fmt.Errorf("error creating RemoveCredentialSources request: %w", err)
+	}
+
+	if len(opts.queryMap) > 0 {
+		q := url.Values{}
+		for k, v := range opts.queryMap {
+			q.Add(k, v)
+		}
+		req.URL.RawQuery = q.Encode()
+	}
+
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("error performing client request during RemoveCredentialSources call: %w", err)
+	}
+
+	target := new(TargetUpdateResult)
+	target.Item = new(Target)
+	apiErr, err := resp.Decode(target.Item)
+	if err != nil {
+		return nil, fmt.Errorf("error decoding RemoveCredentialSources response: %w", err)
+	}
+	if apiErr != nil {
+		return nil, apiErr
+	}
+	target.response = resp
+	return target, nil
+}
+
 func (c *Client) RemoveHostSets(ctx context.Context, id string, version uint32, hostSetIds []string, opt ...Option) (*TargetUpdateResult, error) {
 	if id == "" {
 		return nil, fmt.Errorf("empty id value passed into RemoveHostSets request")

globals/fields.go

@@ -54,4 +54,6 @@ const (
 	CredentialStoreIdField               = "credential_store_id"
 	ApplicationCredentialLibraryIdsField = "application_credential_library_ids"
 	ApplicationCredentialLibrariesField  = "application_credential_libraries"
+	ApplicationCredentialSourceIdsField  = "application_credential_source_ids"
+	ApplicationCredentialSourcesField    = "application_credential_sources"
 )

internal/api/genapi/input.go

@@ -559,6 +559,10 @@ var inputStructs = []*structInfo{
 		inProto: &targets.CredentialLibrary{},
 		outFile: "targets/credential_library.gen.go",
 	},
+	{
+		inProto: &targets.CredentialSource{},
+		outFile: "targets/credential_source.gen.go",
+	},
 	{
 		inProto: &targets.SessionSecret{},
 		outFile: "targets/session_secret.gen.go",
@@ -606,6 +610,7 @@ var inputStructs = []*structInfo{
 				VarName:   "hostSetIds",
 			},
 			"CredentialLibraries": {},
+			"CredentialSources":   {},
 		},
 		extraOptions: []fieldInfo{
 			{
@@ -631,6 +636,11 @@ var inputStructs = []*structInfo{
 				ProtoName: "application_credential_library_ids",
 				FieldType: "[]string",
 			},
+			{
+				Name:      "ApplicationCredentialSourceIds",
+				ProtoName: "application_credential_source_ids",
+				FieldType: "[]string",
+			},
 		},
 		versionEnabled:      true,
 		typeOnCreate:        true,

internal/cmd/commands.go

@@ -914,6 +914,24 @@ func initCommands(ui, serverCmdUi cli.Ui, runOpts *RunOptions) {
 				Func:    "set-credential-libraries",
 			}, nil
 		},
+		"targets add-credential-sources": func() (cli.Command, error) {
+			return &targetscmd.Command{
+				Command: base.NewCommand(ui),
+				Func:    "add-credential-sources",
+			}, nil
+		},
+		"targets remove-credential-sources": func() (cli.Command, error) {
+			return &targetscmd.Command{
+				Command: base.NewCommand(ui),
+				Func:    "remove-credential-sources",
+			}, nil
+		},
+		"targets set-credential-sources": func() (cli.Command, error) {
+			return &targetscmd.Command{
+				Command: base.NewCommand(ui),
+				Func:    "set-credential-sources",
+			}, nil
+		},
 
 		"users": func() (cli.Command, error) {
 			return &userscmd.Command{

internal/cmd/commands/targetscmd/funcs.go

@@ -31,6 +31,7 @@ func init() {
 type extraCmdVars struct {
 	flagHostSets                       []string
 	flagApplicationCredentialLibraries []string
+	flagApplicationCredentialSources   []string
 	flagHostId                         string
 	sar                                *targets.SessionAuthorizationResult
 }
@@ -44,6 +45,9 @@ func extraActionsFlagsMapFuncImpl() map[string][]string {
 		"add-credential-libraries":    {"id", "application-credential-library", "version"},
 		"remove-credential-libraries": {"id", "application-credential-library", "version"},
 		"set-credential-libraries":    {"id", "application-credential-library", "version"},
+		"add-credential-sources":      {"id", "application-credential-source", "version"},
+		"remove-credential-sources":   {"id", "application-credential-source", "version"},
+		"set-credential-sources":      {"id", "application-credential-source", "version"},
 	}
 }
 
@@ -65,12 +69,24 @@ func extraSynopsisFuncImpl(c *Command) string {
 		var in string
 		switch {
 		case strings.HasPrefix(c.Func, "add"):
-			in = "Add credential library to"
+			in = "Add credential libraries to"
 		case strings.HasPrefix(c.Func, "set"):
 			in = "Set the full contents of the credential libraries on"
 		case strings.HasPrefix(c.Func, "remove"):
 			in = "Remove credential libraries from"
 		}
+		return wordwrap.WrapString(fmt.Sprintf("%s a target. DEPRECATED; use the -sources version instead.", in), base.TermWidth)
+
+	case "add-credential-sources", "set-credential-sources", "remove-credential-sources":
+		var in string
+		switch {
+		case strings.HasPrefix(c.Func, "add"):
+			in = "Add credential sources to"
+		case strings.HasPrefix(c.Func, "set"):
+			in = "Set the full contents of the credential sources on"
+		case strings.HasPrefix(c.Func, "remove"):
+			in = "Remove credential sources from"
+		}
 		return wordwrap.WrapString(fmt.Sprintf("%s a target", in), base.TermWidth)
 
 	case "authorize-session":
@@ -160,6 +176,8 @@ func (c *Command) extraHelpFunc(helpMap map[string]func() string) string {
 		helpStr = base.WrapForHelpText([]string{
 			"Usage: boundary target add-credential-libraries [options] [args]",
 			"",
+			"  DEPRECATED: Use add-credential-sources instead.",
+			"",
 			"  This command allows adding credential-library resources to target resources. Example:",
 			"",
 			"    Add credential-library resources to a tcp-type target:",
@@ -172,6 +190,8 @@ func (c *Command) extraHelpFunc(helpMap map[string]func() string) string {
 		helpStr = base.WrapForHelpText([]string{
 			"Usage: boundary target remove-credential-libraries [options] [args]",
 			"",
+			"  DEPRECATED: Use remove-credential-sources instead.",
+			"",
 			"  This command allows removing credential-library resources from target resources. Example:",
 			"",
 			"    Remove credential-library resources from a tcp-type target:",
@@ -184,6 +204,8 @@ func (c *Command) extraHelpFunc(helpMap map[string]func() string) string {
 		helpStr = base.WrapForHelpText([]string{
 			"Usage: boundary target set-credential-libraries [options] [args]",
 			"",
+			"  DEPRECATED: Use set-credential-sources instead.",
+			"",
 			"  This command allows setting the complete set of credential-library resources on a target resource. Example:",
 			"",
 			"    Set credential-library resources on a tcp-type target:",
@@ -192,6 +214,42 @@ func (c *Command) extraHelpFunc(helpMap map[string]func() string) string {
 			"",
 			"",
 		})
+	case "add-credential-sources":
+		helpStr = base.WrapForHelpText([]string{
+			"Usage: boundary target add-credential-sources [options] [args]",
+			"",
+			"  This command allows adding credential sources to target resources. Example:",
+			"",
+			"    Add credential sources to a tcp-type target:",
+			"",
+			`      $ boundary targets add-credential-sources -id ttcp_1234567890 -application-credential-source clvlt_1234567890 -application-credential-source clvlt_0987654321`,
+			"",
+			"",
+		})
+	case "remove-credential-sources":
+		helpStr = base.WrapForHelpText([]string{
+			"Usage: boundary target remove-credential-sources [options] [args]",
+			"",
+			"  This command allows removing credential sources from target resources. Example:",
+			"",
+			"    Remove credential sources from a tcp-type target:",
+			"",
+			`      $ boundary targets remove-credential-sources -id ttcp_1234567890 -application-credential-source clvlt_1234567890 -application-credential-source clvlt_0987654321`,
+			"",
+			"",
+		})
+	case "set-credential-sources":
+		helpStr = base.WrapForHelpText([]string{
+			"Usage: boundary target set-credential-sources [options] [args]",
+			"",
+			"  This command allows setting the complete set of credential sources on a target resource. Example:",
+			"",
+			"    Set credential sources on a tcp-type target:",
+			"",
+			`      $ boundary targets set-credential-sources -id ttcp_1234567890 -application-credential-source clvlt_1234567890`,
+			"",
+			"",
+		})
 	case "authorize-session":
 		helpStr = base.WrapForHelpText([]string{
 			"Usage: boundary target authorize-session [options] [args]",
@@ -233,6 +291,12 @@ func extraFlagsFuncImpl(c *Command, _ *base.FlagSets, f *base.FlagSet) {
 				Target: &c.flagApplicationCredentialLibraries,
 				Usage:  "The credential-library resource for application purpose to add, set, or remove.  May be specified multiple times.",
 			})
+		case "application-credential-source":
+			f.StringSliceVar(&base.StringSliceVar{
+				Name:   "application-credential-source",
+				Target: &c.flagApplicationCredentialSources,
+				Usage:  "The credential source for application purpose to add, set, or remove.  May be specified multiple times.",
+			})
 		}
 	}
 
@@ -322,6 +386,14 @@ func extraFlagsHandlingFuncImpl(c *Command, _ *base.FlagSets, opts *[]targets.Op
 		}
 		*opts = append(*opts, targets.WithApplicationCredentialLibraryIds(c.flagApplicationCredentialLibraries))
 
+	case "add-credential-sources", "remove-credential-sources":
+		// TODO: As we add other purposes, add them to this check
+		if len(c.flagApplicationCredentialSources) == 0 {
+			c.UI.Error("No credential sources supplied via -application-credential-source")
+			return false
+		}
+		*opts = append(*opts, targets.WithApplicationCredentialSourceIds(c.flagApplicationCredentialSources))
+
 	case "set-credential-libraries":
 		// TODO: As we add other purposes, add them to this check
 		switch len(c.flagApplicationCredentialLibraries) {
@@ -338,6 +410,22 @@ func extraFlagsHandlingFuncImpl(c *Command, _ *base.FlagSets, opts *[]targets.Op
 			*opts = append(*opts, targets.WithApplicationCredentialLibraryIds(c.flagApplicationCredentialLibraries))
 		}
 
+	case "set-credential-sources":
+		// TODO: As we add other purposes, add them to this check
+		switch len(c.flagApplicationCredentialSources) {
+		case 0:
+			c.UI.Error("No credential sources supplied via -application-credential-source")
+			return false
+		case 1:
+			if c.flagApplicationCredentialSources[0] == "null" {
+				*opts = append(*opts, targets.DefaultApplicationCredentialSourceIds())
+				break
+			}
+			fallthrough
+		default:
+			*opts = append(*opts, targets.WithApplicationCredentialSourceIds(c.flagApplicationCredentialSources))
+		}
+
 	case "authorize-session":
 		if len(c.flagHostId) != 0 {
 			*opts = append(*opts, targets.WithHostId(c.flagHostId))
@@ -361,6 +449,12 @@ func executeExtraActionsImpl(c *Command, origResult api.GenericResult, origError
 		return targetClient.RemoveCredentialLibraries(c.Context, c.FlagId, version, opts...)
 	case "set-credential-libraries":
 		return targetClient.SetCredentialLibraries(c.Context, c.FlagId, version, opts...)
+	case "add-credential-sources":
+		return targetClient.AddCredentialSources(c.Context, c.FlagId, version, opts...)
+	case "remove-credential-sources":
+		return targetClient.RemoveCredentialSources(c.Context, c.FlagId, version, opts...)
+	case "set-credential-sources":
+		return targetClient.SetCredentialSources(c.Context, c.FlagId, version, opts...)
 	case "authorize-session":
 		var err error
 		c.plural = "a session against target"
@@ -480,20 +574,37 @@ func printItemTable(result api.GenericResult) string {
 		}
 	}
 
-	var libraryMaps map[credential.Purpose][]map[string]interface{}
-	if len(item.ApplicationCredentialLibraries) > 0 {
-		if libraryMaps == nil {
-			libraryMaps = make(map[credential.Purpose][]map[string]interface{})
+	var credentialSourceMaps map[credential.Purpose][]map[string]interface{}
+	if len(item.ApplicationCredentialSources) > 0 {
+		if credentialSourceMaps == nil {
+			credentialSourceMaps = make(map[credential.Purpose][]map[string]interface{})
 		}
-		var applicationLibraryMaps []map[string]interface{}
+		var applicationCredentialSourceMaps []map[string]interface{}
+		for _, lib := range item.ApplicationCredentialSources {
+			m := map[string]interface{}{
+				"ID":                  lib.Id,
+				"Credential Store ID": lib.CredentialStoreId,
+			}
+			applicationCredentialSourceMaps = append(applicationCredentialSourceMaps, m)
+		}
+		credentialSourceMaps[credential.ApplicationPurpose] = applicationCredentialSourceMaps
+		if l := len("Credential Store ID"); l > maxLength {
+			maxLength = l
+		}
+	}
+	if len(item.ApplicationCredentialLibraries) > 0 {
+		if credentialSourceMaps == nil {
+			credentialSourceMaps = make(map[credential.Purpose][]map[string]interface{})
+		}
+		var applicationCredentialSourceMaps []map[string]interface{}
 		for _, lib := range item.ApplicationCredentialLibraries {
 			m := map[string]interface{}{
 				"ID":                  lib.Id,
 				"Credential Store ID": lib.CredentialStoreId,
 			}
-			applicationLibraryMaps = append(applicationLibraryMaps, m)
+			applicationCredentialSourceMaps = append(applicationCredentialSourceMaps, m)
 		}
-		libraryMaps[credential.ApplicationPurpose] = applicationLibraryMaps
+		credentialSourceMaps[credential.ApplicationPurpose] = applicationCredentialSourceMaps
 		if l := len("Credential Store ID"); l > maxLength {
 			maxLength = l
 		}
@@ -537,10 +648,10 @@ func printItemTable(result api.GenericResult) string {
 		}
 	}
 
-	if len(libraryMaps) > 0 {
-		if appMap := libraryMaps[credential.ApplicationPurpose]; len(appMap) > 0 {
+	if len(credentialSourceMaps) > 0 {
+		if appMap := credentialSourceMaps[credential.ApplicationPurpose]; len(appMap) > 0 {
 			ret = append(ret,
-				"  Application Credential Libraries:",
+				"  Application Credential Sources:",
 			)
 			for _, m := range appMap {
 				ret = append(ret,
@@ -609,20 +720,20 @@ func printCustomActionOutputImpl(c *Command) (bool, error) {
 					}
 
 					ret = append(ret,
-						fmt.Sprintf("    Credential Store ID:            %s", cred.CredentialLibrary.CredentialStoreId),
-						fmt.Sprintf("    Credential Library ID:          %s", cred.CredentialLibrary.Id),
-						fmt.Sprintf("    Credential Library Type:        %s", cred.CredentialLibrary.Type))
+						fmt.Sprintf("    Credential Store ID:            %s", cred.CredentialSource.CredentialStoreId),
+						fmt.Sprintf("    Credential Source ID:          %s", cred.CredentialSource.Id),
+						fmt.Sprintf("    Credential Source Type:        %s", cred.CredentialSource.Type))
 
-					if len(cred.CredentialLibrary.Name) > 0 {
+					if len(cred.CredentialSource.Name) > 0 {
 						ret = append(ret,
-							fmt.Sprintf("    Credential Library Name:        %s", cred.CredentialLibrary.Name))
+							fmt.Sprintf("    Credential Source Name:        %s", cred.CredentialSource.Name))
 					}
-					if len(cred.CredentialLibrary.Description) > 0 {
+					if len(cred.CredentialSource.Description) > 0 {
 						ret = append(ret,
-							fmt.Sprintf("    Credential Library Description: %s", cred.CredentialLibrary.Description))
+							fmt.Sprintf("    Credential Source Description: %s", cred.CredentialSource.Description))
 					}
 					var secretStr []string
-					switch cred.CredentialLibrary.Type {
+					switch cred.CredentialSource.Type {
 					case "vault":
 						// If it's Vault, the result will be JSON, except in
 						// specific circumstances that aren't used for

internal/cmd/commands/targetscmd/targets.gen.go

@@ -237,6 +237,30 @@ func (c *Command) Run(args []string) int {
 			version = uint32(c.FlagVersion)
 		}
 
+	case "add-credential-sources":
+		switch c.FlagVersion {
+		case 0:
+			opts = append(opts, targets.WithAutomaticVersioning(true))
+		default:
+			version = uint32(c.FlagVersion)
+		}
+
+	case "remove-credential-sources":
+		switch c.FlagVersion {
+		case 0:
+			opts = append(opts, targets.WithAutomaticVersioning(true))
+		default:
+			version = uint32(c.FlagVersion)
+		}
+
+	case "set-credential-sources":
+		switch c.FlagVersion {
+		case 0:
+			opts = append(opts, targets.WithAutomaticVersioning(true))
+		default:
+			version = uint32(c.FlagVersion)
+		}
+
 	}
 
 	if ok := extraFlagsHandlingFunc(c, f, &opts); !ok {

internal/cmd/gencli/input.go

@@ -386,7 +386,7 @@ var inputStructs = map[string][]*cmdInfo{
 			HasName:             true,
 			HasDescription:      true,
 			Container:           "Scope",
-			VersionedActions:    []string{"add-host-sets", "remove-host-sets", "set-host-sets", "add-credential-libraries", "remove-credential-libraries", "set-credential-libraries"},
+			VersionedActions:    []string{"add-host-sets", "remove-host-sets", "set-host-sets", "add-credential-libraries", "remove-credential-libraries", "set-credential-libraries", "add-credential-sources", "remove-credential-sources", "set-credential-sources"},
 		},
 		{
 			ResourceType:         resource.Target.String(),

internal/gen/controller.swagger.json

@@ -2553,7 +2553,7 @@
     },
     "/v1/targets/{id}:add-credential-libraries": {
       "post": {
-        "summary": "Adds existing Credential Libraries to a Target.",
+        "summary": "Deprecated: use AddTargetCredentialSources instead.",
         "operationId": "TargetService_AddTargetCredentialLibraries",
         "responses": {
           "200": {
@@ -2584,6 +2584,39 @@
         ]
       }
     },
+    "/v1/targets/{id}:add-credential-sources": {
+      "post": {
+        "summary": "Adds existing Credential Sources to a Target.",
+        "operationId": "TargetService_AddTargetCredentialSources",
+        "responses": {
+          "200": {
+            "description": "",
+            "schema": {
+              "$ref": "#/definitions/controller.api.resources.targets.v1.Target"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "type": "string"
+          },
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/controller.api.services.v1.AddTargetCredentialSourcesRequest"
+            }
+          }
+        ],
+        "tags": [
+          "controller.api.services.v1.TargetService"
+        ]
+      }
+    },
     "/v1/targets/{id}:add-host-sets": {
       "post": {
         "summary": "Adds existing Host Sets to a Target.",
@@ -2653,7 +2686,7 @@
     },
     "/v1/targets/{id}:remove-credential-libraries": {
       "post": {
-        "summary": "Removes Credential Libraries from the Target.",
+        "summary": "Deprecated: use RemoveTargetCredentialSources instead.",
         "operationId": "TargetService_RemoveTargetCredentialLibraries",
         "responses": {
           "200": {
@@ -2684,6 +2717,39 @@
         ]
       }
     },
+    "/v1/targets/{id}:remove-credential-sources": {
+      "post": {
+        "summary": "Removes Credential Sources from the Target.",
+        "operationId": "TargetService_RemoveTargetCredentialSources",
+        "responses": {
+          "200": {
+            "description": "",
+            "schema": {
+              "$ref": "#/definitions/controller.api.resources.targets.v1.Target"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "type": "string"
+          },
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/controller.api.services.v1.RemoveTargetCredentialSourcesRequest"
+            }
+          }
+        ],
+        "tags": [
+          "controller.api.services.v1.TargetService"
+        ]
+      }
+    },
     "/v1/targets/{id}:remove-host-sets": {
       "post": {
         "summary": "Removes Host Sets from the Target.",
@@ -2719,7 +2785,7 @@
     },
     "/v1/targets/{id}:set-credential-libraries": {
       "post": {
-        "summary": "Sets the Credential Libraries on the Target.",
+        "summary": "Deprecated: use SetTargetCredentialSources instead.",
         "operationId": "TargetService_SetTargetCredentialLibraries",
         "responses": {
           "200": {
@@ -2750,6 +2816,39 @@
         ]
       }
     },
+    "/v1/targets/{id}:set-credential-sources": {
+      "post": {
+        "summary": "Sets the Credential Sources on the Target.",
+        "operationId": "TargetService_SetTargetCredentialSources",
+        "responses": {
+          "200": {
+            "description": "",
+            "schema": {
+              "$ref": "#/definitions/controller.api.resources.targets.v1.Target"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "type": "string"
+          },
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/controller.api.services.v1.SetTargetCredentialSourcesRequest"
+            }
+          }
+        ],
+        "tags": [
+          "controller.api.services.v1.TargetService"
+        ]
+      }
+    },
     "/v1/targets/{id}:set-host-sets": {
       "post": {
         "summary": "Sets the Host Sets on the Target.",
@@ -4177,6 +4276,35 @@
         }
       }
     },
+    "controller.api.resources.targets.v1.CredentialSource": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string",
+          "description": "The ID of the Credential. May be empty if the credential is dynamically generated from a library."
+        },
+        "name": {
+          "type": "string",
+          "description": "Output only. The name of the Credential source.",
+          "readOnly": true
+        },
+        "description": {
+          "type": "string",
+          "description": "Output only. The description of the Credential source.",
+          "readOnly": true
+        },
+        "credential_store_id": {
+          "type": "string",
+          "description": "Output only. The Credential Store to which this Credential source belongs.",
+          "readOnly": true
+        },
+        "type": {
+          "type": "string",
+          "description": "Output only. The type of the credential source (e.g. \"vault\"; not the type of the credential itself).",
+          "readOnly": true
+        }
+      }
+    },
     "controller.api.resources.targets.v1.HostSet": {
       "type": "object",
       "properties": {
@@ -4260,9 +4388,14 @@
     "controller.api.resources.targets.v1.SessionCredential": {
       "type": "object",
       "properties": {
+        "credential_source": {
+          "$ref": "#/definitions/controller.api.resources.targets.v1.CredentialSource",
+          "description": "Output only. The credential source information.",
+          "readOnly": true
+        },
         "credential_library": {
           "$ref": "#/definitions/controller.api.resources.targets.v1.CredentialLibrary",
-          "description": "Output only. The library which generated this credential.",
+          "description": "Output only. The library which generated this credential. Deprecated: use credential_source instead.",
           "readOnly": true
         },
         "secret": {
@@ -4271,7 +4404,7 @@
           "readOnly": true
         }
       },
-      "description": "A credential for a session."
+      "description": "Credential information for a session."
     },
     "controller.api.resources.targets.v1.SessionSecret": {
       "type": "object",
@@ -4369,14 +4502,29 @@
           "items": {
             "type": "string"
           },
-          "description": "The IDs of the application credential library ids associated with this Target."
+          "description": "The IDs of the application credential library ids associated with this Target. Deprecated: use application_credential_source_ids instead."
         },
         "application_credential_libraries": {
           "type": "array",
           "items": {
             "$ref": "#/definitions/controller.api.resources.targets.v1.CredentialLibrary"
           },
-          "description": "Output only. The application credential libraries associated with this Target.",
+          "description": "Output only. The application credential libraries associated with this Target. Deprecated: use application_credential_sources instead.",
+          "readOnly": true
+        },
+        "application_credential_source_ids": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "The IDs of the application credential source ids associated with this Target."
+        },
+        "application_credential_sources": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/controller.api.resources.targets.v1.CredentialSource"
+          },
+          "description": "Output only. The application credential sources associated with this Target.",
           "readOnly": true
         },
         "attributes": {
@@ -4634,6 +4782,33 @@
         }
       }
     },
+    "controller.api.services.v1.AddTargetCredentialSourcesRequest": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "version": {
+          "type": "integer",
+          "format": "int64",
+          "description": "Version is used to ensure this resource has not changed.\nThe mutation will fail if the version does not match the latest known good version."
+        },
+        "application_credential_source_ids": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "controller.api.services.v1.AddTargetCredentialSourcesResponse": {
+      "type": "object",
+      "properties": {
+        "item": {
+          "$ref": "#/definitions/controller.api.resources.targets.v1.Target"
+        }
+      }
+    },
     "controller.api.services.v1.AddTargetHostSetsRequest": {
       "type": "object",
       "properties": {
@@ -5465,6 +5640,33 @@
         }
       }
     },
+    "controller.api.services.v1.RemoveTargetCredentialSourcesRequest": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "version": {
+          "type": "integer",
+          "format": "int64",
+          "description": "Version is used to ensure this resource has not changed.\nThe mutation will fail if the version does not match the latest known good version."
+        },
+        "application_credential_source_ids": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "controller.api.services.v1.RemoveTargetCredentialSourcesResponse": {
+      "type": "object",
+      "properties": {
+        "item": {
+          "$ref": "#/definitions/controller.api.resources.targets.v1.Target"
+        }
+      }
+    },
     "controller.api.services.v1.RemoveTargetHostSetsRequest": {
       "type": "object",
       "properties": {
@@ -5680,6 +5882,34 @@
         }
       }
     },
+    "controller.api.services.v1.SetTargetCredentialSourcesRequest": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "version": {
+          "type": "integer",
+          "format": "int64",
+          "description": "Version is used to ensure this resource has not changed.\nThe mutation will fail if the version does not match the latest known good version."
+        },
+        "application_credential_source_ids": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      },
+      "description": "Sets the values for application_credential_source_ids.  If any\ncredential_source_id field that is not set in the request will result in\nthose fields being cleared."
+    },
+    "controller.api.services.v1.SetTargetCredentialSourcesResponse": {
+      "type": "object",
+      "properties": {
+        "item": {
+          "$ref": "#/definitions/controller.api.resources.targets.v1.Target"
+        }
+      }
+    },
     "controller.api.services.v1.SetTargetHostSetsRequest": {
       "type": "object",
       "properties": {

internal/gen/controller/api/resources/targets/target.pb.go

@@ -82,6 +82,90 @@ func (x *HostSet) GetHostCatalogId() string {
 	return ""
 }
 
+type CredentialSource struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The ID of the Credential. May be empty if the credential is dynamically generated from a library.
+	Id string `protobuf:"bytes,10,opt,name=id,proto3" json:"id,omitempty"`
+	// Output only. The name of the Credential source.
+	Name string `protobuf:"bytes,20,opt,name=name,proto3" json:"name,omitempty"`
+	// Output only. The description of the Credential source.
+	Description string `protobuf:"bytes,30,opt,name=description,proto3" json:"description,omitempty"`
+	// Output only. The Credential Store to which this Credential source belongs.
+	CredentialStoreId string `protobuf:"bytes,40,opt,name=credential_store_id,proto3" json:"credential_store_id,omitempty"`
+	// Output only. The type of the credential source (e.g. "vault"; not the type of the credential itself).
+	Type string `protobuf:"bytes,60,opt,name=type,proto3" json:"type,omitempty"`
+}
+
+func (x *CredentialSource) Reset() {
+	*x = CredentialSource{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CredentialSource) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CredentialSource) ProtoMessage() {}
+
+func (x *CredentialSource) ProtoReflect() protoreflect.Message {
+	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CredentialSource.ProtoReflect.Descriptor instead.
+func (*CredentialSource) Descriptor() ([]byte, []int) {
+	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *CredentialSource) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *CredentialSource) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *CredentialSource) GetDescription() string {
+	if x != nil {
+		return x.Description
+	}
+	return ""
+}
+
+func (x *CredentialSource) GetCredentialStoreId() string {
+	if x != nil {
+		return x.CredentialStoreId
+	}
+	return ""
+}
+
+func (x *CredentialSource) GetType() string {
+	if x != nil {
+		return x.Type
+	}
+	return ""
+}
+
 type CredentialLibrary struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -102,7 +186,7 @@ type CredentialLibrary struct {
 func (x *CredentialLibrary) Reset() {
 	*x = CredentialLibrary{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[1]
+		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[2]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -115,7 +199,7 @@ func (x *CredentialLibrary) String() string {
 func (*CredentialLibrary) ProtoMessage() {}
 
 func (x *CredentialLibrary) ProtoReflect() protoreflect.Message {
-	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[1]
+	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[2]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -128,7 +212,7 @@ func (x *CredentialLibrary) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CredentialLibrary.ProtoReflect.Descriptor instead.
 func (*CredentialLibrary) Descriptor() ([]byte, []int) {
-	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{1}
+	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{2}
 }
 
 func (x *CredentialLibrary) GetId() string {
@@ -182,7 +266,7 @@ type SessionSecret struct {
 func (x *SessionSecret) Reset() {
 	*x = SessionSecret{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[2]
+		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[3]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -195,7 +279,7 @@ func (x *SessionSecret) String() string {
 func (*SessionSecret) ProtoMessage() {}
 
 func (x *SessionSecret) ProtoReflect() protoreflect.Message {
-	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[2]
+	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[3]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -208,7 +292,7 @@ func (x *SessionSecret) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SessionSecret.ProtoReflect.Descriptor instead.
 func (*SessionSecret) Descriptor() ([]byte, []int) {
-	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{2}
+	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{3}
 }
 
 func (x *SessionSecret) GetRaw() string {
@@ -225,13 +309,17 @@ func (x *SessionSecret) GetDecoded() *structpb.Struct {
 	return nil
 }
 
-// A credential for a session.
+// Credential information for a session.
 type SessionCredential struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	// Output only. The library which generated this credential.
+	// Output only. The credential source information.
+	CredentialSource *CredentialSource `protobuf:"bytes,1,opt,name=credential_source,json=credentialSource,proto3" json:"credential_source,omitempty"`
+	// Output only. The library which generated this credential. Deprecated: use credential_source instead.
+	//
+	// Deprecated: Do not use.
 	CredentialLibrary *CredentialLibrary `protobuf:"bytes,10,opt,name=credential_library,json=credentialLibrary,proto3" json:"credential_library,omitempty"`
 	// Output only. The secret of this credential base64 encoded.
 	Secret *SessionSecret `protobuf:"bytes,20,opt,name=secret,proto3" json:"secret,omitempty"`
@@ -240,7 +328,7 @@ type SessionCredential struct {
 func (x *SessionCredential) Reset() {
 	*x = SessionCredential{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[3]
+		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[4]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -253,7 +341,7 @@ func (x *SessionCredential) String() string {
 func (*SessionCredential) ProtoMessage() {}
 
 func (x *SessionCredential) ProtoReflect() protoreflect.Message {
-	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[3]
+	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[4]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -266,9 +354,17 @@ func (x *SessionCredential) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SessionCredential.ProtoReflect.Descriptor instead.
 func (*SessionCredential) Descriptor() ([]byte, []int) {
-	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{3}
+	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{4}
 }
 
+func (x *SessionCredential) GetCredentialSource() *CredentialSource {
+	if x != nil {
+		return x.CredentialSource
+	}
+	return nil
+}
+
+// Deprecated: Do not use.
 func (x *SessionCredential) GetCredentialLibrary() *CredentialLibrary {
 	if x != nil {
 		return x.CredentialLibrary
@@ -318,10 +414,18 @@ type Target struct {
 	SessionConnectionLimit *wrapperspb.Int32Value `protobuf:"bytes,130,opt,name=session_connection_limit,proto3" json:"session_connection_limit,omitempty"`
 	// Optional boolean expression to filter the workers that are allowed to satisfy this request.
 	WorkerFilter *wrapperspb.StringValue `protobuf:"bytes,140,opt,name=worker_filter,proto3" json:"worker_filter,omitempty"`
-	// The IDs of the application credential library ids associated with this Target.
+	// The IDs of the application credential library ids associated with this Target. Deprecated: use application_credential_source_ids instead.
+	//
+	// Deprecated: Do not use.
 	ApplicationCredentialLibraryIds []string `protobuf:"bytes,150,rep,name=application_credential_library_ids,proto3" json:"application_credential_library_ids,omitempty"`
-	// Output only. The application credential libraries associated with this Target.
+	// Output only. The application credential libraries associated with this Target. Deprecated: use application_credential_sources instead.
+	//
+	// Deprecated: Do not use.
 	ApplicationCredentialLibraries []*CredentialLibrary `protobuf:"bytes,180,rep,name=application_credential_libraries,proto3" json:"application_credential_libraries,omitempty"`
+	// The IDs of the application credential source ids associated with this Target.
+	ApplicationCredentialSourceIds []string `protobuf:"bytes,400,rep,name=application_credential_source_ids,proto3" json:"application_credential_source_ids,omitempty"`
+	// Output only. The application credential sources associated with this Target.
+	ApplicationCredentialSources []*CredentialSource `protobuf:"bytes,410,rep,name=application_credential_sources,proto3" json:"application_credential_sources,omitempty"`
 	// The attributes that are applicable for the specific Target.
 	Attributes *structpb.Struct `protobuf:"bytes,200,opt,name=attributes,proto3" json:"attributes,omitempty"`
 	// Output only. The available actions on this resource for this user.
@@ -331,7 +435,7 @@ type Target struct {
 func (x *Target) Reset() {
 	*x = Target{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[4]
+		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[5]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -344,7 +448,7 @@ func (x *Target) String() string {
 func (*Target) ProtoMessage() {}
 
 func (x *Target) ProtoReflect() protoreflect.Message {
-	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[4]
+	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[5]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -357,7 +461,7 @@ func (x *Target) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Target.ProtoReflect.Descriptor instead.
 func (*Target) Descriptor() ([]byte, []int) {
-	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{4}
+	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *Target) GetId() string {
@@ -458,6 +562,7 @@ func (x *Target) GetWorkerFilter() *wrapperspb.StringValue {
 	return nil
 }
 
+// Deprecated: Do not use.
 func (x *Target) GetApplicationCredentialLibraryIds() []string {
 	if x != nil {
 		return x.ApplicationCredentialLibraryIds
@@ -465,6 +570,7 @@ func (x *Target) GetApplicationCredentialLibraryIds() []string {
 	return nil
 }
 
+// Deprecated: Do not use.
 func (x *Target) GetApplicationCredentialLibraries() []*CredentialLibrary {
 	if x != nil {
 		return x.ApplicationCredentialLibraries
@@ -472,6 +578,20 @@ func (x *Target) GetApplicationCredentialLibraries() []*CredentialLibrary {
 	return nil
 }
 
+func (x *Target) GetApplicationCredentialSourceIds() []string {
+	if x != nil {
+		return x.ApplicationCredentialSourceIds
+	}
+	return nil
+}
+
+func (x *Target) GetApplicationCredentialSources() []*CredentialSource {
+	if x != nil {
+		return x.ApplicationCredentialSources
+	}
+	return nil
+}
+
 func (x *Target) GetAttributes() *structpb.Struct {
 	if x != nil {
 		return x.Attributes
@@ -499,7 +619,7 @@ type TcpTargetAttributes struct {
 func (x *TcpTargetAttributes) Reset() {
 	*x = TcpTargetAttributes{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[5]
+		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[6]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -512,7 +632,7 @@ func (x *TcpTargetAttributes) String() string {
 func (*TcpTargetAttributes) ProtoMessage() {}
 
 func (x *TcpTargetAttributes) ProtoReflect() protoreflect.Message {
-	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[5]
+	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[6]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -525,7 +645,7 @@ func (x *TcpTargetAttributes) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TcpTargetAttributes.ProtoReflect.Descriptor instead.
 func (*TcpTargetAttributes) Descriptor() ([]byte, []int) {
-	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{5}
+	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *TcpTargetAttributes) GetDefaultPort() *wrapperspb.UInt32Value {
@@ -548,7 +668,7 @@ type WorkerInfo struct {
 func (x *WorkerInfo) Reset() {
 	*x = WorkerInfo{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[6]
+		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[7]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -561,7 +681,7 @@ func (x *WorkerInfo) String() string {
 func (*WorkerInfo) ProtoMessage() {}
 
 func (x *WorkerInfo) ProtoReflect() protoreflect.Message {
-	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[6]
+	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[7]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -574,7 +694,7 @@ func (x *WorkerInfo) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WorkerInfo.ProtoReflect.Descriptor instead.
 func (*WorkerInfo) Descriptor() ([]byte, []int) {
-	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{6}
+	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *WorkerInfo) GetAddress() string {
@@ -617,7 +737,7 @@ type SessionAuthorizationData struct {
 func (x *SessionAuthorizationData) Reset() {
 	*x = SessionAuthorizationData{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[7]
+		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[8]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -630,7 +750,7 @@ func (x *SessionAuthorizationData) String() string {
 func (*SessionAuthorizationData) ProtoMessage() {}
 
 func (x *SessionAuthorizationData) ProtoReflect() protoreflect.Message {
-	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[7]
+	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[8]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -643,7 +763,7 @@ func (x *SessionAuthorizationData) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SessionAuthorizationData.ProtoReflect.Descriptor instead.
 func (*SessionAuthorizationData) Descriptor() ([]byte, []int) {
-	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{7}
+	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *SessionAuthorizationData) GetSessionId() string {
@@ -756,7 +876,7 @@ type SessionAuthorization struct {
 func (x *SessionAuthorization) Reset() {
 	*x = SessionAuthorization{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[8]
+		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[9]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -769,7 +889,7 @@ func (x *SessionAuthorization) String() string {
 func (*SessionAuthorization) ProtoMessage() {}
 
 func (x *SessionAuthorization) ProtoReflect() protoreflect.Message {
-	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[8]
+	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[9]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -782,7 +902,7 @@ func (x *SessionAuthorization) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SessionAuthorization.ProtoReflect.Descriptor instead.
 func (*SessionAuthorization) Descriptor() ([]byte, []int) {
-	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{8}
+	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{9}
 }
 
 func (x *SessionAuthorization) GetSessionId() string {
@@ -886,109 +1006,139 @@ var file_controller_api_resources_targets_v1_target_proto_rawDesc = []byte{
 	0x02, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x28, 0x0a,
 	0x0f, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x5f, 0x69, 0x64,
 	0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x63, 0x61, 0x74,
-	0x61, 0x6c, 0x6f, 0x67, 0x5f, 0x69, 0x64, 0x22, 0x9f, 0x01, 0x0a, 0x11, 0x43, 0x72, 0x65, 0x64,
-	0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x4c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x12, 0x0e, 0x0a,
-	0x02, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x12, 0x0a,
-	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d,
-	0x65, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e,
-	0x18, 0x1e, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74,
-	0x69, 0x6f, 0x6e, 0x12, 0x30, 0x0a, 0x13, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61,
-	0x6c, 0x5f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x28, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x13, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x74, 0x6f,
-	0x72, 0x65, 0x5f, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x3c, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x22, 0x54, 0x0a, 0x0d, 0x53, 0x65, 0x73,
-	0x73, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x72, 0x61,
-	0x77, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x72, 0x61, 0x77, 0x12, 0x31, 0x0a, 0x07,
-	0x64, 0x65, 0x63, 0x6f, 0x64, 0x65, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e,
-	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
-	0x53, 0x74, 0x72, 0x75, 0x63, 0x74, 0x52, 0x07, 0x64, 0x65, 0x63, 0x6f, 0x64, 0x65, 0x64, 0x22,
-	0xc6, 0x01, 0x0a, 0x11, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x43, 0x72, 0x65, 0x64, 0x65,
-	0x6e, 0x74, 0x69, 0x61, 0x6c, 0x12, 0x65, 0x0a, 0x12, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74,
-	0x69, 0x61, 0x6c, 0x5f, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x18, 0x0a, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x36, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61,
+	0x61, 0x6c, 0x6f, 0x67, 0x5f, 0x69, 0x64, 0x22, 0x9e, 0x01, 0x0a, 0x10, 0x43, 0x72, 0x65, 0x64,
+	0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x0e, 0x0a, 0x02,
+	0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04,
+	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65,
+	0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18,
+	0x1e, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69,
+	0x6f, 0x6e, 0x12, 0x30, 0x0a, 0x13, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c,
+	0x5f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x28, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x13, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x74, 0x6f, 0x72,
+	0x65, 0x5f, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x3c, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x22, 0x9f, 0x01, 0x0a, 0x11, 0x43, 0x72, 0x65,
+	0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x4c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x12, 0x0e,
+	0x0a, 0x02, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x12,
+	0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61,
+	0x6d, 0x65, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f,
+	0x6e, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70,
+	0x74, 0x69, 0x6f, 0x6e, 0x12, 0x30, 0x0a, 0x13, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69,
+	0x61, 0x6c, 0x5f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x28, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x13, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x74,
+	0x6f, 0x72, 0x65, 0x5f, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x3c,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x22, 0x54, 0x0a, 0x0d, 0x53, 0x65,
+	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x72,
+	0x61, 0x77, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x72, 0x61, 0x77, 0x12, 0x31, 0x0a,
+	0x07, 0x64, 0x65, 0x63, 0x6f, 0x64, 0x65, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17,
+	0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
+	0x2e, 0x53, 0x74, 0x72, 0x75, 0x63, 0x74, 0x52, 0x07, 0x64, 0x65, 0x63, 0x6f, 0x64, 0x65, 0x64,
+	0x22, 0xae, 0x02, 0x0a, 0x11, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x43, 0x72, 0x65, 0x64,
+	0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x12, 0x62, 0x0a, 0x11, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e,
+	0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x35, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61,
 	0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72,
 	0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69,
-	0x61, 0x6c, 0x4c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x52, 0x11, 0x63, 0x72, 0x65, 0x64, 0x65,
-	0x6e, 0x74, 0x69, 0x61, 0x6c, 0x4c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x12, 0x4a, 0x0a, 0x06,
-	0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x18, 0x14, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x32, 0x2e, 0x63,
-	0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e,
-	0x76, 0x31, 0x2e, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74,
-	0x52, 0x06, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x22, 0x91, 0x0a, 0x0a, 0x06, 0x54, 0x61, 0x72,
-	0x67, 0x65, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x02, 0x69, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x5f, 0x69, 0x64, 0x18,
-	0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x5f, 0x69, 0x64, 0x12,
-	0x43, 0x0a, 0x05, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d,
-	0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e,
-	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73,
-	0x2e, 0x76, 0x31, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x05, 0x73,
-	0x63, 0x6f, 0x70, 0x65, 0x12, 0x46, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x28, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65,
-	0x42, 0x14, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29, 0x0c, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65,
-	0x12, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x62, 0x0a, 0x0b,
-	0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x32, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42,
-	0x22, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29, 0x1a, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72,
-	0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74,
-	0x69, 0x6f, 0x6e, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e,
-	0x12, 0x3e, 0x0a, 0x0c, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65,
-	0x18, 0x3c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
-	0x6d, 0x70, 0x52, 0x0c, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65,
-	0x12, 0x3e, 0x0a, 0x0c, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65,
-	0x18, 0x46, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
-	0x6d, 0x70, 0x52, 0x0c, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65,
-	0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x50, 0x20, 0x01, 0x28,
-	0x0d, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79,
-	0x70, 0x65, 0x18, 0x5a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x22,
-	0x0a, 0x0c, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x64,
-	0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x5f, 0x69,
-	0x64, 0x73, 0x12, 0x4a, 0x0a, 0x09, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x73, 0x18,
-	0x6e, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c,
+	0x61, 0x6c, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x10, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e,
+	0x74, 0x69, 0x61, 0x6c, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x69, 0x0a, 0x12, 0x63, 0x72,
+	0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79,
+	0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x36, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c,
+	0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65,
+	0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x4c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x42, 0x02,
+	0x18, 0x01, 0x52, 0x11, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x4c, 0x69,
+	0x62, 0x72, 0x61, 0x72, 0x79, 0x12, 0x4a, 0x0a, 0x06, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x18,
+	0x14, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x32, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c,
 	0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73,
-	0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x48, 0x6f, 0x73, 0x74,
-	0x53, 0x65, 0x74, 0x52, 0x09, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x73, 0x12, 0x80,
-	0x01, 0x0a, 0x13, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x78, 0x5f, 0x73,
-	0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x18, 0x78, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67,
-	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x55,
-	0x49, 0x6e, 0x74, 0x33, 0x32, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x30, 0xa0, 0xda, 0x29, 0x01,
-	0xc2, 0xdd, 0x29, 0x28, 0x0a, 0x13, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61,
-	0x78, 0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x12, 0x11, 0x53, 0x65, 0x73, 0x73, 0x69,
-	0x6f, 0x6e, 0x4d, 0x61, 0x78, 0x53, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x52, 0x13, 0x73, 0x65,
-	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x78, 0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64,
-	0x73, 0x12, 0x94, 0x01, 0x0a, 0x18, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x6f,
-	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x18, 0x82,
-	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x49, 0x6e, 0x74, 0x33, 0x32, 0x56, 0x61, 0x6c,
-	0x75, 0x65, 0x42, 0x3a, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29, 0x32, 0x0a, 0x18, 0x73, 0x65,
-	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x12, 0x16, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x43,
-	0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x52, 0x18,
-	0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x12, 0x6a, 0x0a, 0x0d, 0x77, 0x6f, 0x72, 0x6b,
-	0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x18, 0x8c, 0x01, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
-	0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x25,
-	0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29, 0x1d, 0x0a, 0x0d, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72,
-	0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x12, 0x0c, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x46,
-	0x69, 0x6c, 0x74, 0x65, 0x72, 0x52, 0x0d, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69,
-	0x6c, 0x74, 0x65, 0x72, 0x12, 0x4f, 0x0a, 0x22, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74,
-	0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x6c,
-	0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x96, 0x01, 0x20, 0x03, 0x28,
-	0x09, 0x52, 0x22, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63,
-	0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72,
-	0x79, 0x5f, 0x69, 0x64, 0x73, 0x12, 0x83, 0x01, 0x0a, 0x20, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63,
+	0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x73, 0x73,
+	0x69, 0x6f, 0x6e, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x52, 0x06, 0x73, 0x65, 0x63, 0x72, 0x65,
+	0x74, 0x22, 0xe8, 0x0b, 0x0a, 0x06, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74, 0x12, 0x0e, 0x0a, 0x02,
+	0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x1a, 0x0a, 0x08,
+	0x73, 0x63, 0x6f, 0x70, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
+	0x73, 0x63, 0x6f, 0x70, 0x65, 0x5f, 0x69, 0x64, 0x12, 0x43, 0x0a, 0x05, 0x73, 0x63, 0x6f, 0x70,
+	0x65, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f,
+	0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x73, 0x2e, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x63, 0x6f,
+	0x70, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x05, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x12, 0x46, 0x0a,
+	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x28, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74,
+	0x72, 0x69, 0x6e, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x14, 0xa0, 0xda, 0x29, 0x01, 0xc2,
+	0xdd, 0x29, 0x0c, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x52,
+	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x62, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70,
+	0x74, 0x69, 0x6f, 0x6e, 0x18, 0x32, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f,
+	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72,
+	0x69, 0x6e, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x22, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd,
+	0x29, 0x1a, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12,
+	0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0b, 0x64, 0x65,
+	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x3e, 0x0a, 0x0c, 0x63, 0x72, 0x65,
+	0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x3c, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0c, 0x63, 0x72, 0x65,
+	0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x12, 0x3e, 0x0a, 0x0c, 0x75, 0x70, 0x64,
+	0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x46, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0c, 0x75, 0x70, 0x64,
+	0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72,
+	0x73, 0x69, 0x6f, 0x6e, 0x18, 0x50, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73,
+	0x69, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x5a, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x22, 0x0a, 0x0c, 0x68, 0x6f, 0x73, 0x74, 0x5f,
+	0x73, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x64, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x68,
+	0x6f, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x73, 0x12, 0x4a, 0x0a, 0x09, 0x68,
+	0x6f, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x73, 0x18, 0x6e, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2c,
+	0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74,
+	0x73, 0x2e, 0x76, 0x31, 0x2e, 0x48, 0x6f, 0x73, 0x74, 0x53, 0x65, 0x74, 0x52, 0x09, 0x68, 0x6f,
+	0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x73, 0x12, 0x80, 0x01, 0x0a, 0x13, 0x73, 0x65, 0x73, 0x73,
+	0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x78, 0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x18,
+	0x78, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x55, 0x49, 0x6e, 0x74, 0x33, 0x32, 0x56, 0x61,
+	0x6c, 0x75, 0x65, 0x42, 0x30, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29, 0x28, 0x0a, 0x13, 0x73,
+	0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x78, 0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e,
+	0x64, 0x73, 0x12, 0x11, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x4d, 0x61, 0x78, 0x53, 0x65,
+	0x63, 0x6f, 0x6e, 0x64, 0x73, 0x52, 0x13, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6d,
+	0x61, 0x78, 0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x12, 0x94, 0x01, 0x0a, 0x18, 0x73,
+	0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x18, 0x82, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b,
+	0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
+	0x2e, 0x49, 0x6e, 0x74, 0x33, 0x32, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x3a, 0xa0, 0xda, 0x29,
+	0x01, 0xc2, 0xdd, 0x29, 0x32, 0x0a, 0x18, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x63,
+	0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x12,
+	0x16, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x52, 0x18, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e,
+	0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6c, 0x69, 0x6d, 0x69,
+	0x74, 0x12, 0x6a, 0x0a, 0x0d, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74,
+	0x65, 0x72, 0x18, 0x8c, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x69,
+	0x6e, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x25, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29,
+	0x1d, 0x0a, 0x0d, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72,
+	0x12, 0x0c, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x52, 0x0d,
+	0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x12, 0x53, 0x0a,
+	0x22, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65,
+	0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x5f,
+	0x69, 0x64, 0x73, 0x18, 0x96, 0x01, 0x20, 0x03, 0x28, 0x09, 0x42, 0x02, 0x18, 0x01, 0x52, 0x22,
+	0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64,
+	0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x5f, 0x69,
+	0x64, 0x73, 0x12, 0x87, 0x01, 0x0a, 0x20, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x6c, 0x69,
+	0x62, 0x72, 0x61, 0x72, 0x69, 0x65, 0x73, 0x18, 0xb4, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x36,
+	0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74,
+	0x73, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x4c,
+	0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x42, 0x02, 0x18, 0x01, 0x52, 0x20, 0x61, 0x70, 0x70, 0x6c,
+	0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69,
+	0x61, 0x6c, 0x5f, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x69, 0x65, 0x73, 0x12, 0x4d, 0x0a, 0x21,
+	0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64,
+	0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64,
+	0x73, 0x18, 0x90, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x21, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63,
 	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c,
-	0x5f, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x69, 0x65, 0x73, 0x18, 0xb4, 0x01, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x36, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61,
-	0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72,
-	0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69,
-	0x61, 0x6c, 0x4c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x52, 0x20, 0x61, 0x70, 0x70, 0x6c, 0x69,
-	0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61,
-	0x6c, 0x5f, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x69, 0x65, 0x73, 0x12, 0x3e, 0x0a, 0x0a, 0x61,
+	0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x73, 0x12, 0x7e, 0x0a, 0x1e, 0x61,
+	0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65,
+	0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x9a, 0x03,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x35, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65,
+	0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e,
+	0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x64, 0x65,
+	0x6e, 0x74, 0x69, 0x61, 0x6c, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x1e, 0x61, 0x70, 0x70,
+	0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74,
+	0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x3e, 0x0a, 0x0a, 0x61,
 	0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x18, 0xc8, 0x01, 0x20, 0x01, 0x28, 0x0b,
 	0x32, 0x17, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
 	0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x75, 0x63, 0x74, 0x42, 0x04, 0xa0, 0xda, 0x29, 0x01, 0x52,
@@ -1089,51 +1239,54 @@ func file_controller_api_resources_targets_v1_target_proto_rawDescGZIP() []byte
 	return file_controller_api_resources_targets_v1_target_proto_rawDescData
 }
 
-var file_controller_api_resources_targets_v1_target_proto_msgTypes = make([]protoimpl.MessageInfo, 9)
+var file_controller_api_resources_targets_v1_target_proto_msgTypes = make([]protoimpl.MessageInfo, 10)
 var file_controller_api_resources_targets_v1_target_proto_goTypes = []interface{}{
 	(*HostSet)(nil),                  // 0: controller.api.resources.targets.v1.HostSet
-	(*CredentialLibrary)(nil),        // 1: controller.api.resources.targets.v1.CredentialLibrary
-	(*SessionSecret)(nil),            // 2: controller.api.resources.targets.v1.SessionSecret
-	(*SessionCredential)(nil),        // 3: controller.api.resources.targets.v1.SessionCredential
-	(*Target)(nil),                   // 4: controller.api.resources.targets.v1.Target
-	(*TcpTargetAttributes)(nil),      // 5: controller.api.resources.targets.v1.TcpTargetAttributes
-	(*WorkerInfo)(nil),               // 6: controller.api.resources.targets.v1.WorkerInfo
-	(*SessionAuthorizationData)(nil), // 7: controller.api.resources.targets.v1.SessionAuthorizationData
-	(*SessionAuthorization)(nil),     // 8: controller.api.resources.targets.v1.SessionAuthorization
-	(*structpb.Struct)(nil),          // 9: google.protobuf.Struct
-	(*scopes.ScopeInfo)(nil),         // 10: controller.api.resources.scopes.v1.ScopeInfo
-	(*wrapperspb.StringValue)(nil),   // 11: google.protobuf.StringValue
-	(*timestamppb.Timestamp)(nil),    // 12: google.protobuf.Timestamp
-	(*wrapperspb.UInt32Value)(nil),   // 13: google.protobuf.UInt32Value
-	(*wrapperspb.Int32Value)(nil),    // 14: google.protobuf.Int32Value
+	(*CredentialSource)(nil),         // 1: controller.api.resources.targets.v1.CredentialSource
+	(*CredentialLibrary)(nil),        // 2: controller.api.resources.targets.v1.CredentialLibrary
+	(*SessionSecret)(nil),            // 3: controller.api.resources.targets.v1.SessionSecret
+	(*SessionCredential)(nil),        // 4: controller.api.resources.targets.v1.SessionCredential
+	(*Target)(nil),                   // 5: controller.api.resources.targets.v1.Target
+	(*TcpTargetAttributes)(nil),      // 6: controller.api.resources.targets.v1.TcpTargetAttributes
+	(*WorkerInfo)(nil),               // 7: controller.api.resources.targets.v1.WorkerInfo
+	(*SessionAuthorizationData)(nil), // 8: controller.api.resources.targets.v1.SessionAuthorizationData
+	(*SessionAuthorization)(nil),     // 9: controller.api.resources.targets.v1.SessionAuthorization
+	(*structpb.Struct)(nil),          // 10: google.protobuf.Struct
+	(*scopes.ScopeInfo)(nil),         // 11: controller.api.resources.scopes.v1.ScopeInfo
+	(*wrapperspb.StringValue)(nil),   // 12: google.protobuf.StringValue
+	(*timestamppb.Timestamp)(nil),    // 13: google.protobuf.Timestamp
+	(*wrapperspb.UInt32Value)(nil),   // 14: google.protobuf.UInt32Value
+	(*wrapperspb.Int32Value)(nil),    // 15: google.protobuf.Int32Value
 }
 var file_controller_api_resources_targets_v1_target_proto_depIdxs = []int32{
-	9,  // 0: controller.api.resources.targets.v1.SessionSecret.decoded:type_name -> google.protobuf.Struct
-	1,  // 1: controller.api.resources.targets.v1.SessionCredential.credential_library:type_name -> controller.api.resources.targets.v1.CredentialLibrary
-	2,  // 2: controller.api.resources.targets.v1.SessionCredential.secret:type_name -> controller.api.resources.targets.v1.SessionSecret
-	10, // 3: controller.api.resources.targets.v1.Target.scope:type_name -> controller.api.resources.scopes.v1.ScopeInfo
-	11, // 4: controller.api.resources.targets.v1.Target.name:type_name -> google.protobuf.StringValue
-	11, // 5: controller.api.resources.targets.v1.Target.description:type_name -> google.protobuf.StringValue
-	12, // 6: controller.api.resources.targets.v1.Target.created_time:type_name -> google.protobuf.Timestamp
-	12, // 7: controller.api.resources.targets.v1.Target.updated_time:type_name -> google.protobuf.Timestamp
-	0,  // 8: controller.api.resources.targets.v1.Target.host_sets:type_name -> controller.api.resources.targets.v1.HostSet
-	13, // 9: controller.api.resources.targets.v1.Target.session_max_seconds:type_name -> google.protobuf.UInt32Value
-	14, // 10: controller.api.resources.targets.v1.Target.session_connection_limit:type_name -> google.protobuf.Int32Value
-	11, // 11: controller.api.resources.targets.v1.Target.worker_filter:type_name -> google.protobuf.StringValue
-	1,  // 12: controller.api.resources.targets.v1.Target.application_credential_libraries:type_name -> controller.api.resources.targets.v1.CredentialLibrary
-	9,  // 13: controller.api.resources.targets.v1.Target.attributes:type_name -> google.protobuf.Struct
-	13, // 14: controller.api.resources.targets.v1.TcpTargetAttributes.default_port:type_name -> google.protobuf.UInt32Value
-	10, // 15: controller.api.resources.targets.v1.SessionAuthorizationData.scope:type_name -> controller.api.resources.scopes.v1.ScopeInfo
-	12, // 16: controller.api.resources.targets.v1.SessionAuthorizationData.created_time:type_name -> google.protobuf.Timestamp
-	6,  // 17: controller.api.resources.targets.v1.SessionAuthorizationData.worker_info:type_name -> controller.api.resources.targets.v1.WorkerInfo
-	10, // 18: controller.api.resources.targets.v1.SessionAuthorization.scope:type_name -> controller.api.resources.scopes.v1.ScopeInfo
-	12, // 19: controller.api.resources.targets.v1.SessionAuthorization.created_time:type_name -> google.protobuf.Timestamp
-	3,  // 20: controller.api.resources.targets.v1.SessionAuthorization.credentials:type_name -> controller.api.resources.targets.v1.SessionCredential
-	21, // [21:21] is the sub-list for method output_type
-	21, // [21:21] is the sub-list for method input_type
-	21, // [21:21] is the sub-list for extension type_name
-	21, // [21:21] is the sub-list for extension extendee
-	0,  // [0:21] is the sub-list for field type_name
+	10, // 0: controller.api.resources.targets.v1.SessionSecret.decoded:type_name -> google.protobuf.Struct
+	1,  // 1: controller.api.resources.targets.v1.SessionCredential.credential_source:type_name -> controller.api.resources.targets.v1.CredentialSource
+	2,  // 2: controller.api.resources.targets.v1.SessionCredential.credential_library:type_name -> controller.api.resources.targets.v1.CredentialLibrary
+	3,  // 3: controller.api.resources.targets.v1.SessionCredential.secret:type_name -> controller.api.resources.targets.v1.SessionSecret
+	11, // 4: controller.api.resources.targets.v1.Target.scope:type_name -> controller.api.resources.scopes.v1.ScopeInfo
+	12, // 5: controller.api.resources.targets.v1.Target.name:type_name -> google.protobuf.StringValue
+	12, // 6: controller.api.resources.targets.v1.Target.description:type_name -> google.protobuf.StringValue
+	13, // 7: controller.api.resources.targets.v1.Target.created_time:type_name -> google.protobuf.Timestamp
+	13, // 8: controller.api.resources.targets.v1.Target.updated_time:type_name -> google.protobuf.Timestamp
+	0,  // 9: controller.api.resources.targets.v1.Target.host_sets:type_name -> controller.api.resources.targets.v1.HostSet
+	14, // 10: controller.api.resources.targets.v1.Target.session_max_seconds:type_name -> google.protobuf.UInt32Value
+	15, // 11: controller.api.resources.targets.v1.Target.session_connection_limit:type_name -> google.protobuf.Int32Value
+	12, // 12: controller.api.resources.targets.v1.Target.worker_filter:type_name -> google.protobuf.StringValue
+	2,  // 13: controller.api.resources.targets.v1.Target.application_credential_libraries:type_name -> controller.api.resources.targets.v1.CredentialLibrary
+	1,  // 14: controller.api.resources.targets.v1.Target.application_credential_sources:type_name -> controller.api.resources.targets.v1.CredentialSource
+	10, // 15: controller.api.resources.targets.v1.Target.attributes:type_name -> google.protobuf.Struct
+	14, // 16: controller.api.resources.targets.v1.TcpTargetAttributes.default_port:type_name -> google.protobuf.UInt32Value
+	11, // 17: controller.api.resources.targets.v1.SessionAuthorizationData.scope:type_name -> controller.api.resources.scopes.v1.ScopeInfo
+	13, // 18: controller.api.resources.targets.v1.SessionAuthorizationData.created_time:type_name -> google.protobuf.Timestamp
+	7,  // 19: controller.api.resources.targets.v1.SessionAuthorizationData.worker_info:type_name -> controller.api.resources.targets.v1.WorkerInfo
+	11, // 20: controller.api.resources.targets.v1.SessionAuthorization.scope:type_name -> controller.api.resources.scopes.v1.ScopeInfo
+	13, // 21: controller.api.resources.targets.v1.SessionAuthorization.created_time:type_name -> google.protobuf.Timestamp
+	4,  // 22: controller.api.resources.targets.v1.SessionAuthorization.credentials:type_name -> controller.api.resources.targets.v1.SessionCredential
+	23, // [23:23] is the sub-list for method output_type
+	23, // [23:23] is the sub-list for method input_type
+	23, // [23:23] is the sub-list for extension type_name
+	23, // [23:23] is the sub-list for extension extendee
+	0,  // [0:23] is the sub-list for field type_name
 }
 
 func init() { file_controller_api_resources_targets_v1_target_proto_init() }
@@ -1155,7 +1308,7 @@ func file_controller_api_resources_targets_v1_target_proto_init() {
 			}
 		}
 		file_controller_api_resources_targets_v1_target_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CredentialLibrary); i {
+			switch v := v.(*CredentialSource); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1167,7 +1320,7 @@ func file_controller_api_resources_targets_v1_target_proto_init() {
 			}
 		}
 		file_controller_api_resources_targets_v1_target_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SessionSecret); i {
+			switch v := v.(*CredentialLibrary); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1179,7 +1332,7 @@ func file_controller_api_resources_targets_v1_target_proto_init() {
 			}
 		}
 		file_controller_api_resources_targets_v1_target_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SessionCredential); i {
+			switch v := v.(*SessionSecret); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1191,7 +1344,7 @@ func file_controller_api_resources_targets_v1_target_proto_init() {
 			}
 		}
 		file_controller_api_resources_targets_v1_target_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Target); i {
+			switch v := v.(*SessionCredential); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1203,7 +1356,7 @@ func file_controller_api_resources_targets_v1_target_proto_init() {
 			}
 		}
 		file_controller_api_resources_targets_v1_target_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*TcpTargetAttributes); i {
+			switch v := v.(*Target); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1215,7 +1368,7 @@ func file_controller_api_resources_targets_v1_target_proto_init() {
 			}
 		}
 		file_controller_api_resources_targets_v1_target_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*WorkerInfo); i {
+			switch v := v.(*TcpTargetAttributes); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1227,7 +1380,7 @@ func file_controller_api_resources_targets_v1_target_proto_init() {
 			}
 		}
 		file_controller_api_resources_targets_v1_target_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SessionAuthorizationData); i {
+			switch v := v.(*WorkerInfo); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1239,6 +1392,18 @@ func file_controller_api_resources_targets_v1_target_proto_init() {
 			}
 		}
 		file_controller_api_resources_targets_v1_target_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SessionAuthorizationData); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_controller_api_resources_targets_v1_target_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*SessionAuthorization); i {
 			case 0:
 				return &v.state
@@ -1257,7 +1422,7 @@ func file_controller_api_resources_targets_v1_target_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_controller_api_resources_targets_v1_target_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   9,
+			NumMessages:   10,
 			NumExtensions: 0,
 			NumServices:   0,
 		},

internal/gen/controller/api/services/target_service.pb.gw.go

@@ -781,6 +781,210 @@ func local_request_TargetService_RemoveTargetCredentialLibraries_0(ctx context.C
 
 }
 
+func request_TargetService_AddTargetCredentialSources_0(ctx context.Context, marshaler runtime.Marshaler, client TargetServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq AddTargetCredentialSourcesRequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	var (
+		val string
+		ok  bool
+		err error
+		_   = err
+	)
+
+	val, ok = pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+
+	protoReq.Id, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+
+	msg, err := client.AddTargetCredentialSources(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_TargetService_AddTargetCredentialSources_0(ctx context.Context, marshaler runtime.Marshaler, server TargetServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq AddTargetCredentialSourcesRequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	var (
+		val string
+		ok  bool
+		err error
+		_   = err
+	)
+
+	val, ok = pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+
+	protoReq.Id, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+
+	msg, err := server.AddTargetCredentialSources(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_TargetService_SetTargetCredentialSources_0(ctx context.Context, marshaler runtime.Marshaler, client TargetServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq SetTargetCredentialSourcesRequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	var (
+		val string
+		ok  bool
+		err error
+		_   = err
+	)
+
+	val, ok = pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+
+	protoReq.Id, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+
+	msg, err := client.SetTargetCredentialSources(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_TargetService_SetTargetCredentialSources_0(ctx context.Context, marshaler runtime.Marshaler, server TargetServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq SetTargetCredentialSourcesRequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	var (
+		val string
+		ok  bool
+		err error
+		_   = err
+	)
+
+	val, ok = pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+
+	protoReq.Id, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+
+	msg, err := server.SetTargetCredentialSources(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_TargetService_RemoveTargetCredentialSources_0(ctx context.Context, marshaler runtime.Marshaler, client TargetServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq RemoveTargetCredentialSourcesRequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	var (
+		val string
+		ok  bool
+		err error
+		_   = err
+	)
+
+	val, ok = pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+
+	protoReq.Id, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+
+	msg, err := client.RemoveTargetCredentialSources(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_TargetService_RemoveTargetCredentialSources_0(ctx context.Context, marshaler runtime.Marshaler, server TargetServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq RemoveTargetCredentialSourcesRequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	var (
+		val string
+		ok  bool
+		err error
+		_   = err
+	)
+
+	val, ok = pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+
+	protoReq.Id, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+
+	msg, err := server.RemoveTargetCredentialSources(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
 // RegisterTargetServiceHandlerServer registers the http handlers for service TargetService to "mux".
 // UnaryRPC     :call TargetServiceServer directly.
 // StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
@@ -1063,6 +1267,75 @@ func RegisterTargetServiceHandlerServer(ctx context.Context, mux *runtime.ServeM
 
 	})
 
+	mux.Handle("POST", pattern_TargetService_AddTargetCredentialSources_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/controller.api.services.v1.TargetService/AddTargetCredentialSources")
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_TargetService_AddTargetCredentialSources_0(rctx, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_TargetService_AddTargetCredentialSources_0(ctx, mux, outboundMarshaler, w, req, response_TargetService_AddTargetCredentialSources_0{resp}, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_TargetService_SetTargetCredentialSources_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/controller.api.services.v1.TargetService/SetTargetCredentialSources")
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_TargetService_SetTargetCredentialSources_0(rctx, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_TargetService_SetTargetCredentialSources_0(ctx, mux, outboundMarshaler, w, req, response_TargetService_SetTargetCredentialSources_0{resp}, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_TargetService_RemoveTargetCredentialSources_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/controller.api.services.v1.TargetService/RemoveTargetCredentialSources")
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_TargetService_RemoveTargetCredentialSources_0(rctx, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_TargetService_RemoveTargetCredentialSources_0(ctx, mux, outboundMarshaler, w, req, response_TargetService_RemoveTargetCredentialSources_0{resp}, mux.GetForwardResponseOptions()...)
+
+	})
+
 	return nil
 }
 
@@ -1344,6 +1617,66 @@ func RegisterTargetServiceHandlerClient(ctx context.Context, mux *runtime.ServeM
 
 	})
 
+	mux.Handle("POST", pattern_TargetService_AddTargetCredentialSources_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateContext(ctx, mux, req, "/controller.api.services.v1.TargetService/AddTargetCredentialSources")
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_TargetService_AddTargetCredentialSources_0(rctx, inboundMarshaler, client, req, pathParams)
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_TargetService_AddTargetCredentialSources_0(ctx, mux, outboundMarshaler, w, req, response_TargetService_AddTargetCredentialSources_0{resp}, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_TargetService_SetTargetCredentialSources_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateContext(ctx, mux, req, "/controller.api.services.v1.TargetService/SetTargetCredentialSources")
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_TargetService_SetTargetCredentialSources_0(rctx, inboundMarshaler, client, req, pathParams)
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_TargetService_SetTargetCredentialSources_0(ctx, mux, outboundMarshaler, w, req, response_TargetService_SetTargetCredentialSources_0{resp}, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_TargetService_RemoveTargetCredentialSources_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateContext(ctx, mux, req, "/controller.api.services.v1.TargetService/RemoveTargetCredentialSources")
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_TargetService_RemoveTargetCredentialSources_0(rctx, inboundMarshaler, client, req, pathParams)
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_TargetService_RemoveTargetCredentialSources_0(ctx, mux, outboundMarshaler, w, req, response_TargetService_RemoveTargetCredentialSources_0{resp}, mux.GetForwardResponseOptions()...)
+
+	})
+
 	return nil
 }
 
@@ -1437,6 +1770,33 @@ func (m response_TargetService_RemoveTargetCredentialLibraries_0) XXX_ResponseBo
 	return response.Item
 }
 
+type response_TargetService_AddTargetCredentialSources_0 struct {
+	proto.Message
+}
+
+func (m response_TargetService_AddTargetCredentialSources_0) XXX_ResponseBody() interface{} {
+	response := m.Message.(*AddTargetCredentialSourcesResponse)
+	return response.Item
+}
+
+type response_TargetService_SetTargetCredentialSources_0 struct {
+	proto.Message
+}
+
+func (m response_TargetService_SetTargetCredentialSources_0) XXX_ResponseBody() interface{} {
+	response := m.Message.(*SetTargetCredentialSourcesResponse)
+	return response.Item
+}
+
+type response_TargetService_RemoveTargetCredentialSources_0 struct {
+	proto.Message
+}
+
+func (m response_TargetService_RemoveTargetCredentialSources_0) XXX_ResponseBody() interface{} {
+	response := m.Message.(*RemoveTargetCredentialSourcesResponse)
+	return response.Item
+}
+
 var (
 	pattern_TargetService_GetTarget_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 1, 0, 4, 1, 5, 2}, []string{"v1", "targets", "id"}, ""))
 
@@ -1461,6 +1821,12 @@ var (
 	pattern_TargetService_SetTargetCredentialLibraries_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 1, 0, 4, 1, 5, 2}, []string{"v1", "targets", "id"}, "set-credential-libraries"))
 
 	pattern_TargetService_RemoveTargetCredentialLibraries_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 1, 0, 4, 1, 5, 2}, []string{"v1", "targets", "id"}, "remove-credential-libraries"))
+
+	pattern_TargetService_AddTargetCredentialSources_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 1, 0, 4, 1, 5, 2}, []string{"v1", "targets", "id"}, "add-credential-sources"))
+
+	pattern_TargetService_SetTargetCredentialSources_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 1, 0, 4, 1, 5, 2}, []string{"v1", "targets", "id"}, "set-credential-sources"))
+
+	pattern_TargetService_RemoveTargetCredentialSources_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 1, 0, 4, 1, 5, 2}, []string{"v1", "targets", "id"}, "remove-credential-sources"))
 )
 
 var (
@@ -1487,4 +1853,10 @@ var (
 	forward_TargetService_SetTargetCredentialLibraries_0 = runtime.ForwardResponseMessage
 
 	forward_TargetService_RemoveTargetCredentialLibraries_0 = runtime.ForwardResponseMessage
+
+	forward_TargetService_AddTargetCredentialSources_0 = runtime.ForwardResponseMessage
+
+	forward_TargetService_SetTargetCredentialSources_0 = runtime.ForwardResponseMessage
+
+	forward_TargetService_RemoveTargetCredentialSources_0 = runtime.ForwardResponseMessage
 )

internal/gen/controller/api/services/target_service_grpc.pb.go

@@ -71,6 +71,7 @@ type TargetServiceClient interface {
 	// returned.  An error is returned if a Host Set is attempted to be
 	// removed from the Target when the Target does not have the Host Set.
 	RemoveTargetHostSets(ctx context.Context, in *RemoveTargetHostSetsRequest, opts ...grpc.CallOption) (*RemoveTargetHostSetsResponse, error)
+	// Deprecated: Do not use.
 	// AddTargetCredentialLibraries adds Credential Libraries to this Target.
 	// The provided request must include the Target ID to which the Credential
 	// Libraries will be added. All Credential Libraries added to the provided
@@ -80,6 +81,7 @@ type TargetServiceClient interface {
 	// Credential Library is attempted to be added to a target that is already
 	// present on the Target.
 	AddTargetCredentialLibraries(ctx context.Context, in *AddTargetCredentialLibrariesRequest, opts ...grpc.CallOption) (*AddTargetCredentialLibrariesResponse, error)
+	// Deprecated: Do not use.
 	// SetTargetCredentialLibraries sets the Target's Credential Libraries.
 	// Any existing Credential Libraries on the Target are deleted if they are
 	// not included in this request. The provided request must include the scope,
@@ -88,6 +90,7 @@ type TargetServiceClient interface {
 	// in the same scope as the provided Target. If any IDs are missing,
 	// malformed, or references a non-existing resource, an error is returned.
 	SetTargetCredentialLibraries(ctx context.Context, in *SetTargetCredentialLibrariesRequest, opts ...grpc.CallOption) (*SetTargetCredentialLibrariesResponse, error)
+	// Deprecated: Do not use.
 	// RemoveTargetCredentialLibraries removes the Credential Libraries from the
 	// specified Target. The provided request must include the Target ID for the
 	// Target from which the Credential Libraries will be removed. If the ID is
@@ -95,6 +98,30 @@ type TargetServiceClient interface {
 	// Credential Library is attempted to be removed from the Target when the
 	// Target does not have the Credential Library.
 	RemoveTargetCredentialLibraries(ctx context.Context, in *RemoveTargetCredentialLibrariesRequest, opts ...grpc.CallOption) (*RemoveTargetCredentialLibrariesResponse, error)
+	// AddTargetCredentialSources adds Credential Sources to this Target.
+	// The provided request must include the Target ID to which the Credential
+	// Sources will be added. All Credential Sources added to the provided
+	// Target must be a child of a Store that is in the same scope as this
+	// Target. If the scope or Target IDs are missing, malformed, or reference
+	// non-existing resources, an error is returned. An error is returned if a
+	// Credential Source is attempted to be added to a target that is already
+	// present on the Target.
+	AddTargetCredentialSources(ctx context.Context, in *AddTargetCredentialSourcesRequest, opts ...grpc.CallOption) (*AddTargetCredentialSourcesResponse, error)
+	// SetTargetCredentialSources sets the Target's Credential Sources.
+	// Any existing Credential Sources on the Target are deleted if they are
+	// not included in this request. The provided request must include the scope,
+	// and the Target ID on which the Credential Sources will be set.  All
+	// Credential Sources in the request must be a child of a Store that is
+	// in the same scope as the provided Target. If any IDs are missing,
+	// malformed, or references a non-existing resource, an error is returned.
+	SetTargetCredentialSources(ctx context.Context, in *SetTargetCredentialSourcesRequest, opts ...grpc.CallOption) (*SetTargetCredentialSourcesResponse, error)
+	// RemoveTargetCredentialSources removes the Credential Sources from the
+	// specified Target. The provided request must include the Target ID for the
+	// Target from which the Credential Sources will be removed. If the ID is
+	// missing, or malformed, an error is returned.  An error is returned if a
+	// Credential Library is attempted to be removed from the Target when the
+	// Target does not have the Credential Source.
+	RemoveTargetCredentialSources(ctx context.Context, in *RemoveTargetCredentialSourcesRequest, opts ...grpc.CallOption) (*RemoveTargetCredentialSourcesResponse, error)
 }
 
 type targetServiceClient struct {
@@ -186,6 +213,7 @@ func (c *targetServiceClient) RemoveTargetHostSets(ctx context.Context, in *Remo
 	return out, nil
 }
 
+// Deprecated: Do not use.
 func (c *targetServiceClient) AddTargetCredentialLibraries(ctx context.Context, in *AddTargetCredentialLibrariesRequest, opts ...grpc.CallOption) (*AddTargetCredentialLibrariesResponse, error) {
 	out := new(AddTargetCredentialLibrariesResponse)
 	err := c.cc.Invoke(ctx, "/controller.api.services.v1.TargetService/AddTargetCredentialLibraries", in, out, opts...)
@@ -195,6 +223,7 @@ func (c *targetServiceClient) AddTargetCredentialLibraries(ctx context.Context,
 	return out, nil
 }
 
+// Deprecated: Do not use.
 func (c *targetServiceClient) SetTargetCredentialLibraries(ctx context.Context, in *SetTargetCredentialLibrariesRequest, opts ...grpc.CallOption) (*SetTargetCredentialLibrariesResponse, error) {
 	out := new(SetTargetCredentialLibrariesResponse)
 	err := c.cc.Invoke(ctx, "/controller.api.services.v1.TargetService/SetTargetCredentialLibraries", in, out, opts...)
@@ -204,6 +233,7 @@ func (c *targetServiceClient) SetTargetCredentialLibraries(ctx context.Context,
 	return out, nil
 }
 
+// Deprecated: Do not use.
 func (c *targetServiceClient) RemoveTargetCredentialLibraries(ctx context.Context, in *RemoveTargetCredentialLibrariesRequest, opts ...grpc.CallOption) (*RemoveTargetCredentialLibrariesResponse, error) {
 	out := new(RemoveTargetCredentialLibrariesResponse)
 	err := c.cc.Invoke(ctx, "/controller.api.services.v1.TargetService/RemoveTargetCredentialLibraries", in, out, opts...)
@@ -213,6 +243,33 @@ func (c *targetServiceClient) RemoveTargetCredentialLibraries(ctx context.Contex
 	return out, nil
 }
 
+func (c *targetServiceClient) AddTargetCredentialSources(ctx context.Context, in *AddTargetCredentialSourcesRequest, opts ...grpc.CallOption) (*AddTargetCredentialSourcesResponse, error) {
+	out := new(AddTargetCredentialSourcesResponse)
+	err := c.cc.Invoke(ctx, "/controller.api.services.v1.TargetService/AddTargetCredentialSources", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *targetServiceClient) SetTargetCredentialSources(ctx context.Context, in *SetTargetCredentialSourcesRequest, opts ...grpc.CallOption) (*SetTargetCredentialSourcesResponse, error) {
+	out := new(SetTargetCredentialSourcesResponse)
+	err := c.cc.Invoke(ctx, "/controller.api.services.v1.TargetService/SetTargetCredentialSources", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *targetServiceClient) RemoveTargetCredentialSources(ctx context.Context, in *RemoveTargetCredentialSourcesRequest, opts ...grpc.CallOption) (*RemoveTargetCredentialSourcesResponse, error) {
+	out := new(RemoveTargetCredentialSourcesResponse)
+	err := c.cc.Invoke(ctx, "/controller.api.services.v1.TargetService/RemoveTargetCredentialSources", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // TargetServiceServer is the server API for TargetService service.
 // All implementations must embed UnimplementedTargetServiceServer
 // for forward compatibility
@@ -270,6 +327,7 @@ type TargetServiceServer interface {
 	// returned.  An error is returned if a Host Set is attempted to be
 	// removed from the Target when the Target does not have the Host Set.
 	RemoveTargetHostSets(context.Context, *RemoveTargetHostSetsRequest) (*RemoveTargetHostSetsResponse, error)
+	// Deprecated: Do not use.
 	// AddTargetCredentialLibraries adds Credential Libraries to this Target.
 	// The provided request must include the Target ID to which the Credential
 	// Libraries will be added. All Credential Libraries added to the provided
@@ -279,6 +337,7 @@ type TargetServiceServer interface {
 	// Credential Library is attempted to be added to a target that is already
 	// present on the Target.
 	AddTargetCredentialLibraries(context.Context, *AddTargetCredentialLibrariesRequest) (*AddTargetCredentialLibrariesResponse, error)
+	// Deprecated: Do not use.
 	// SetTargetCredentialLibraries sets the Target's Credential Libraries.
 	// Any existing Credential Libraries on the Target are deleted if they are
 	// not included in this request. The provided request must include the scope,
@@ -287,6 +346,7 @@ type TargetServiceServer interface {
 	// in the same scope as the provided Target. If any IDs are missing,
 	// malformed, or references a non-existing resource, an error is returned.
 	SetTargetCredentialLibraries(context.Context, *SetTargetCredentialLibrariesRequest) (*SetTargetCredentialLibrariesResponse, error)
+	// Deprecated: Do not use.
 	// RemoveTargetCredentialLibraries removes the Credential Libraries from the
 	// specified Target. The provided request must include the Target ID for the
 	// Target from which the Credential Libraries will be removed. If the ID is
@@ -294,6 +354,30 @@ type TargetServiceServer interface {
 	// Credential Library is attempted to be removed from the Target when the
 	// Target does not have the Credential Library.
 	RemoveTargetCredentialLibraries(context.Context, *RemoveTargetCredentialLibrariesRequest) (*RemoveTargetCredentialLibrariesResponse, error)
+	// AddTargetCredentialSources adds Credential Sources to this Target.
+	// The provided request must include the Target ID to which the Credential
+	// Sources will be added. All Credential Sources added to the provided
+	// Target must be a child of a Store that is in the same scope as this
+	// Target. If the scope or Target IDs are missing, malformed, or reference
+	// non-existing resources, an error is returned. An error is returned if a
+	// Credential Source is attempted to be added to a target that is already
+	// present on the Target.
+	AddTargetCredentialSources(context.Context, *AddTargetCredentialSourcesRequest) (*AddTargetCredentialSourcesResponse, error)
+	// SetTargetCredentialSources sets the Target's Credential Sources.
+	// Any existing Credential Sources on the Target are deleted if they are
+	// not included in this request. The provided request must include the scope,
+	// and the Target ID on which the Credential Sources will be set.  All
+	// Credential Sources in the request must be a child of a Store that is
+	// in the same scope as the provided Target. If any IDs are missing,
+	// malformed, or references a non-existing resource, an error is returned.
+	SetTargetCredentialSources(context.Context, *SetTargetCredentialSourcesRequest) (*SetTargetCredentialSourcesResponse, error)
+	// RemoveTargetCredentialSources removes the Credential Sources from the
+	// specified Target. The provided request must include the Target ID for the
+	// Target from which the Credential Sources will be removed. If the ID is
+	// missing, or malformed, an error is returned.  An error is returned if a
+	// Credential Library is attempted to be removed from the Target when the
+	// Target does not have the Credential Source.
+	RemoveTargetCredentialSources(context.Context, *RemoveTargetCredentialSourcesRequest) (*RemoveTargetCredentialSourcesResponse, error)
 	mustEmbedUnimplementedTargetServiceServer()
 }
 
@@ -337,6 +421,15 @@ func (UnimplementedTargetServiceServer) SetTargetCredentialLibraries(context.Con
 func (UnimplementedTargetServiceServer) RemoveTargetCredentialLibraries(context.Context, *RemoveTargetCredentialLibrariesRequest) (*RemoveTargetCredentialLibrariesResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method RemoveTargetCredentialLibraries not implemented")
 }
+func (UnimplementedTargetServiceServer) AddTargetCredentialSources(context.Context, *AddTargetCredentialSourcesRequest) (*AddTargetCredentialSourcesResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method AddTargetCredentialSources not implemented")
+}
+func (UnimplementedTargetServiceServer) SetTargetCredentialSources(context.Context, *SetTargetCredentialSourcesRequest) (*SetTargetCredentialSourcesResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method SetTargetCredentialSources not implemented")
+}
+func (UnimplementedTargetServiceServer) RemoveTargetCredentialSources(context.Context, *RemoveTargetCredentialSourcesRequest) (*RemoveTargetCredentialSourcesResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RemoveTargetCredentialSources not implemented")
+}
 func (UnimplementedTargetServiceServer) mustEmbedUnimplementedTargetServiceServer() {}
 
 // UnsafeTargetServiceServer may be embedded to opt out of forward compatibility for this service.
@@ -566,6 +659,60 @@ func _TargetService_RemoveTargetCredentialLibraries_Handler(srv interface{}, ctx
 	return interceptor(ctx, in, info, handler)
 }
 
+func _TargetService_AddTargetCredentialSources_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(AddTargetCredentialSourcesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TargetServiceServer).AddTargetCredentialSources(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/controller.api.services.v1.TargetService/AddTargetCredentialSources",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TargetServiceServer).AddTargetCredentialSources(ctx, req.(*AddTargetCredentialSourcesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _TargetService_SetTargetCredentialSources_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(SetTargetCredentialSourcesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TargetServiceServer).SetTargetCredentialSources(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/controller.api.services.v1.TargetService/SetTargetCredentialSources",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TargetServiceServer).SetTargetCredentialSources(ctx, req.(*SetTargetCredentialSourcesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _TargetService_RemoveTargetCredentialSources_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RemoveTargetCredentialSourcesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TargetServiceServer).RemoveTargetCredentialSources(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/controller.api.services.v1.TargetService/RemoveTargetCredentialSources",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TargetServiceServer).RemoveTargetCredentialSources(ctx, req.(*RemoveTargetCredentialSourcesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // TargetService_ServiceDesc is the grpc.ServiceDesc for TargetService service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -621,6 +768,18 @@ var TargetService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "RemoveTargetCredentialLibraries",
 			Handler:    _TargetService_RemoveTargetCredentialLibraries_Handler,
 		},
+		{
+			MethodName: "AddTargetCredentialSources",
+			Handler:    _TargetService_AddTargetCredentialSources_Handler,
+		},
+		{
+			MethodName: "SetTargetCredentialSources",
+			Handler:    _TargetService_SetTargetCredentialSources_Handler,
+		},
+		{
+			MethodName: "RemoveTargetCredentialSources",
+			Handler:    _TargetService_RemoveTargetCredentialSources_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "controller/api/services/v1/target_service.proto",

internal/observability/event/context_test.go

@@ -494,7 +494,6 @@ func Test_WriteObservation(t *testing.T) {
 		assert.NoError(err)
 		assert.Len(b, 0)
 	})
-
 }
 
 func Test_Filtering(t *testing.T) {

internal/observability/event/node_test.go

@@ -133,7 +133,6 @@ func Test_NewCloudEventsNode(t *testing.T) {
 			for _, f := range got.deny {
 				assert.Contains(tt.wantDeny, f.raw)
 			}
-
 		})
 	}
 }

internal/proto/local/controller/api/resources/targets/v1/target.proto

@@ -10,7 +10,7 @@ import "google/protobuf/struct.proto";
 import "controller/api/resources/scopes/v1/scope.proto";
 import "controller/custom_options/v1/options.proto";
 
-message HostSet{
+message HostSet {
 	// Output only. The ID of the Host Set.
 	string id = 10;
 
@@ -18,7 +18,24 @@ message HostSet{
 	string host_catalog_id = 20 [json_name="host_catalog_id"];
 }
 
-message CredentialLibrary{
+message CredentialSource {
+	// The ID of the Credential. May be empty if the credential is dynamically generated from a library.
+	string id = 10;
+
+	// Output only. The name of the Credential source.
+	string name = 20;
+
+	// Output only. The description of the Credential source.
+	string description = 30;
+
+	// Output only. The Credential Store to which this Credential source belongs.
+	string credential_store_id = 40 [json_name="credential_store_id"];
+
+	// Output only. The type of the credential source (e.g. "vault"; not the type of the credential itself).
+	string type = 60;
+}
+
+message CredentialLibrary {
 	// The ID of the Credential Library.
 	string id = 10;
 
@@ -45,10 +62,13 @@ message SessionSecret {
 	google.protobuf.Struct decoded = 20;
 }
 
-// A credential for a session.
+// Credential information for a session.
 message SessionCredential {
-	// Output only. The library which generated this credential.
-	CredentialLibrary credential_library = 10;
+	// Output only. The credential source information.
+	CredentialSource credential_source = 1;
+
+	// Output only. The library which generated this credential. Deprecated: use credential_source instead.
+	CredentialLibrary credential_library = 10 [deprecated = true];
 
 	// Output only. The secret of this credential base64 encoded.
 	SessionSecret secret = 20;
@@ -99,17 +119,15 @@ message Target {
 	// Optional boolean expression to filter the workers that are allowed to satisfy this request.
 	google.protobuf.StringValue worker_filter = 140 [json_name="worker_filter", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = {this: "worker_filter" that: "WorkerFilter"}];
 
-	// The IDs of the application credential library ids associated with this Target.
-	repeated string application_credential_library_ids = 150 [json_name="application_credential_library_ids"];
+	// The IDs of the application credential library ids associated with this Target. Deprecated: use application_credential_source_ids instead.
+	repeated string application_credential_library_ids = 150 [json_name="application_credential_library_ids", deprecated = true];
+	// Output only. The application credential libraries associated with this Target. Deprecated: use application_credential_sources instead.
+	repeated CredentialLibrary application_credential_libraries = 180 [json_name="application_credential_libraries", deprecated = true];
 
-	// TODO: Uncomment when we suport more purposes beyond application
-//	// The IDs of the egress credential libraries associated with this Target.
-//	repeated string egress_credential_library_ids = 160 [json_name="egress_credential_library_ids"];
-//	// The IDs of the ingress credential libraries associated with this Target.
-//	repeated string ingress_credential_library_ids = 170 [json_name="ingress_credential_library_ids"];
-
-	// Output only. The application credential libraries associated with this Target.
-	repeated CredentialLibrary application_credential_libraries = 180 [json_name="application_credential_libraries"];
+	// The IDs of the application credential source ids associated with this Target.
+	repeated string application_credential_source_ids = 400 [json_name="application_credential_source_ids"];
+	// Output only. The application credential sources associated with this Target.
+	repeated CredentialSource application_credential_sources = 410 [json_name="application_credential_sources"];
 
 	// TODO: Uncomment when we suport more purposes beyond application
 //	// Output only. The egress credential libraries associated with this Target.

internal/proto/local/controller/api/services/v1/target_service.proto

@@ -164,8 +164,9 @@ service TargetService {
       response_body: "item"
     };
     option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
-      summary: "Adds existing Credential Libraries to a Target."
+      summary: "Deprecated: use AddTargetCredentialSources instead."
     };
+    option deprecated = true;
   }
 
   // SetTargetCredentialLibraries sets the Target's Credential Libraries.
@@ -182,8 +183,9 @@ service TargetService {
       response_body: "item"
     };
     option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
-      summary: "Sets the Credential Libraries on the Target."
+      summary: "Deprecated: use SetTargetCredentialSources instead."
     };
+    option deprecated = true;
   }
 
   // RemoveTargetCredentialLibraries removes the Credential Libraries from the
@@ -199,10 +201,64 @@ service TargetService {
       response_body: "item"
     };
     option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
-      summary: "Removes Credential Libraries from the Target."
+      summary: "Deprecated: use RemoveTargetCredentialSources instead."
+    };
+    option deprecated = true;
+  }
+
+  // AddTargetCredentialSources adds Credential Sources to this Target.
+  // The provided request must include the Target ID to which the Credential
+  // Sources will be added. All Credential Sources added to the provided
+  // Target must be a child of a Store that is in the same scope as this
+  // Target. If the scope or Target IDs are missing, malformed, or reference
+  // non-existing resources, an error is returned. An error is returned if a
+  // Credential Source is attempted to be added to a target that is already
+  // present on the Target.
+  rpc AddTargetCredentialSources(AddTargetCredentialSourcesRequest) returns (AddTargetCredentialSourcesResponse) {
+    option (google.api.http) = {
+      post: "/v1/targets/{id}:add-credential-sources"
+      body: "*"
+      response_body: "item"
+    };
+    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
+      summary: "Adds existing Credential Sources to a Target."
     };
   }
 
+  // SetTargetCredentialSources sets the Target's Credential Sources.
+  // Any existing Credential Sources on the Target are deleted if they are
+  // not included in this request. The provided request must include the scope,
+  // and the Target ID on which the Credential Sources will be set.  All
+  // Credential Sources in the request must be a child of a Store that is
+  // in the same scope as the provided Target. If any IDs are missing,
+  // malformed, or references a non-existing resource, an error is returned.
+  rpc SetTargetCredentialSources(SetTargetCredentialSourcesRequest) returns (SetTargetCredentialSourcesResponse) {
+    option (google.api.http) = {
+      post: "/v1/targets/{id}:set-credential-sources"
+      body: "*"
+      response_body: "item"
+    };
+    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
+      summary: "Sets the Credential Sources on the Target."
+    };
+  }
+
+  // RemoveTargetCredentialSources removes the Credential Sources from the
+  // specified Target. The provided request must include the Target ID for the
+  // Target from which the Credential Sources will be removed. If the ID is
+  // missing, or malformed, an error is returned.  An error is returned if a
+  // Credential Source is attempted to be removed from the Target when the
+  // Target does not have the Credential Source.
+  rpc RemoveTargetCredentialSources(RemoveTargetCredentialSourcesRequest) returns (RemoveTargetCredentialSourcesResponse) {
+    option (google.api.http) = {
+      post: "/v1/targets/{id}:remove-credential-sources"
+      body: "*"
+      response_body: "item"
+    };
+    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
+      summary: "Removes Credential Sources from the Target."
+    };
+  }
 }
 
 message GetTargetRequest {
@@ -290,9 +346,6 @@ message AddTargetCredentialLibrariesRequest {
   // The mutation will fail if the version does not match the latest known good version.
   uint32 version = 2;
   repeated string application_credential_library_ids = 3 [json_name="application_credential_library_ids"];
-  // TODO: Uncomment when we support more purposes beyond application
-//  repeated string egress_credential_library_ids = 4 [json_name="egress_credential_library_ids"];
-//  repeated string ingress_credential_library_ids = 5 [json_name="ingress_credential_library_ids"];
 }
 
 message AddTargetCredentialLibrariesResponse {
@@ -308,9 +361,6 @@ message SetTargetCredentialLibrariesRequest {
   // The mutation will fail if the version does not match the latest known good version.
   uint32 version = 2;
   repeated string application_credential_library_ids = 3 [json_name="application_credential_library_ids"];
-  // TODO: Uncomment when we support more purposes beyond application
-  //  repeated string egress_credential_library_ids = 4 [json_name="egress_credential_library_ids"];
-  //  repeated string ingress_credential_library_ids = 5 [json_name="ingress_credential_library_ids"];
 }
 
 message SetTargetCredentialLibrariesResponse {
@@ -323,15 +373,51 @@ message RemoveTargetCredentialLibrariesRequest {
   // The mutation will fail if the version does not match the latest known good version.
   uint32 version = 2;
   repeated string application_credential_library_ids = 3 [json_name="application_credential_library_ids"];
-  // TODO: Uncomment when we support more purposes beyond application
-  //  repeated string egress_credential_library_ids = 4 [json_name="egress_credential_library_ids"];
-  //  repeated string ingress_credential_library_ids = 5 [json_name="ingress_credential_library_ids"];
 }
 
 message RemoveTargetCredentialLibrariesResponse {
   api.resources.targets.v1.Target item = 1;
 }
 
+message AddTargetCredentialSourcesRequest {
+  string id = 1;
+  // Version is used to ensure this resource has not changed.
+  // The mutation will fail if the version does not match the latest known good version.
+  uint32 version = 2;
+  repeated string application_credential_source_ids = 3 [json_name="application_credential_source_ids"];
+}
+
+message AddTargetCredentialSourcesResponse {
+  api.resources.targets.v1.Target item = 1;
+}
+
+// Sets the values for application_credential_source_ids.  If any
+// credential_source_id field that is not set in the request will result in
+// those fields being cleared.
+message SetTargetCredentialSourcesRequest {
+  string id = 1;
+  // Version is used to ensure this resource has not changed.
+  // The mutation will fail if the version does not match the latest known good version.
+  uint32 version = 2;
+  repeated string application_credential_source_ids = 3 [json_name="application_credential_source_ids"];
+}
+
+message SetTargetCredentialSourcesResponse {
+  api.resources.targets.v1.Target item = 1;
+}
+
+message RemoveTargetCredentialSourcesRequest {
+  string id = 1;
+  // Version is used to ensure this resource has not changed.
+  // The mutation will fail if the version does not match the latest known good version.
+  uint32 version = 2;
+  repeated string application_credential_source_ids = 3 [json_name="application_credential_source_id"];
+}
+
+message RemoveTargetCredentialSourcesResponse {
+  api.resources.targets.v1.Target item = 1;
+}
+
 message AuthorizeSessionRequest {
   // The ID of the target. Required unless some combination of scope_id/scope_name and name are set.
   string id = 1;
@@ -351,4 +437,4 @@ message AuthorizeSessionRequest {
 
 message AuthorizeSessionResponse {
   api.resources.targets.v1.SessionAuthorization item = 1;
-}
+}

internal/servers/controller/handlers/targets/target_service.go

@@ -61,6 +61,9 @@ var (
 		action.AddCredentialLibraries,
 		action.SetCredentialLibraries,
 		action.RemoveCredentialLibraries,
+		action.AddCredentialSources,
+		action.SetCredentialSources,
+		action.RemoveCredentialSources,
 		action.AuthorizeSession,
 	}
 
@@ -451,7 +454,7 @@ func (s Service) RemoveTargetHostSets(ctx context.Context, req *pbs.RemoveTarget
 	return &pbs.RemoveTargetHostSetsResponse{Item: item}, nil
 }
 
-// AddTargetCredentialLibraries implements the interface pbs.TargetServiceServer.
+// DEPRECATED: AddTargetCredentialLibraries implements the interface pbs.TargetServiceServer.
 func (s Service) AddTargetCredentialLibraries(ctx context.Context, req *pbs.AddTargetCredentialLibrariesRequest) (*pbs.AddTargetCredentialLibrariesResponse, error) {
 	const op = "targets.(Service).AddTargetCredentialLibraries"
 
@@ -462,7 +465,7 @@ func (s Service) AddTargetCredentialLibraries(ctx context.Context, req *pbs.AddT
 	if authResults.Error != nil {
 		return nil, authResults.Error
 	}
-	t, ts, cl, err := s.addLibrariesInRepo(ctx, req.GetId(), req.GetApplicationCredentialLibraryIds(), req.GetVersion())
+	t, ts, cl, err := s.addCredentialSourcesInRepo(ctx, req.GetId(), req.GetApplicationCredentialLibraryIds(), req.GetVersion())
 	if err != nil {
 		return nil, err
 	}
@@ -489,7 +492,7 @@ func (s Service) AddTargetCredentialLibraries(ctx context.Context, req *pbs.AddT
 	return &pbs.AddTargetCredentialLibrariesResponse{Item: item}, nil
 }
 
-// SetTargetCredentialLibraries implements the interface pbs.TargetServiceServer.
+// DEPRECATED: SetTargetCredentialLibraries implements the interface pbs.TargetServiceServer.
 func (s Service) SetTargetCredentialLibraries(ctx context.Context, req *pbs.SetTargetCredentialLibrariesRequest) (*pbs.SetTargetCredentialLibrariesResponse, error) {
 	const op = "targets.(Service).SetTargetCredentialLibraries"
 
@@ -500,7 +503,7 @@ func (s Service) SetTargetCredentialLibraries(ctx context.Context, req *pbs.SetT
 	if authResults.Error != nil {
 		return nil, authResults.Error
 	}
-	t, ts, cl, err := s.setLibrariesInRepo(ctx, req.GetId(), req.GetApplicationCredentialLibraryIds(), req.GetVersion())
+	t, ts, cl, err := s.setCredentialSourcesInRepo(ctx, req.GetId(), req.GetApplicationCredentialLibraryIds(), req.GetVersion())
 	if err != nil {
 		return nil, err
 	}
@@ -527,7 +530,7 @@ func (s Service) SetTargetCredentialLibraries(ctx context.Context, req *pbs.SetT
 	return &pbs.SetTargetCredentialLibrariesResponse{Item: item}, nil
 }
 
-// RemoveTargetCredentialLibraries implements the interface pbs.TargetServiceServer.
+// DEPRECATED: RemoveTargetCredentialLibraries implements the interface pbs.TargetServiceServer.
 func (s Service) RemoveTargetCredentialLibraries(ctx context.Context, req *pbs.RemoveTargetCredentialLibrariesRequest) (*pbs.RemoveTargetCredentialLibrariesResponse, error) {
 	const op = "targets.(Service).RemoveTargetCredentialLibraries"
 
@@ -538,7 +541,7 @@ func (s Service) RemoveTargetCredentialLibraries(ctx context.Context, req *pbs.R
 	if authResults.Error != nil {
 		return nil, authResults.Error
 	}
-	t, ts, cl, err := s.removeLibrariesInRepo(ctx, req.GetId(), req.GetApplicationCredentialLibraryIds(), req.GetVersion())
+	t, ts, cl, err := s.removeCredentialSourcesInRepo(ctx, req.GetId(), req.GetApplicationCredentialLibraryIds(), req.GetVersion())
 	if err != nil {
 		return nil, err
 	}
@@ -565,6 +568,120 @@ func (s Service) RemoveTargetCredentialLibraries(ctx context.Context, req *pbs.R
 	return &pbs.RemoveTargetCredentialLibrariesResponse{Item: item}, nil
 }
 
+// AddTargetCredentialSources implements the interface pbs.TargetServiceServer.
+func (s Service) AddTargetCredentialSources(ctx context.Context, req *pbs.AddTargetCredentialSourcesRequest) (*pbs.AddTargetCredentialSourcesResponse, error) {
+	const op = "targets.(Service).AddTargetCredentialSources"
+
+	if err := validateAddCredentialSourcesRequest(req); err != nil {
+		return nil, err
+	}
+	authResults := s.authResult(ctx, req.GetId(), action.AddCredentialSources)
+	if authResults.Error != nil {
+		return nil, authResults.Error
+	}
+	t, ts, cl, err := s.addCredentialSourcesInRepo(ctx, req.GetId(), req.GetApplicationCredentialSourceIds(), req.GetVersion())
+	if err != nil {
+		return nil, err
+	}
+
+	outputFields, ok := requests.OutputFields(ctx)
+	if !ok {
+		return nil, errors.New(errors.Internal, op, "no request context found")
+	}
+
+	outputOpts := make([]handlers.Option, 0, 3)
+	outputOpts = append(outputOpts, handlers.WithOutputFields(&outputFields))
+	if outputFields.Has(globals.ScopeField) {
+		outputOpts = append(outputOpts, handlers.WithScope(authResults.Scope))
+	}
+	if outputFields.Has(globals.AuthorizedActionsField) {
+		outputOpts = append(outputOpts, handlers.WithAuthorizedActions(authResults.FetchActionSetForId(ctx, t.GetPublicId(), IdActions).Strings()))
+	}
+
+	item, err := toProto(ctx, t, ts, cl, outputOpts...)
+	if err != nil {
+		return nil, err
+	}
+
+	return &pbs.AddTargetCredentialSourcesResponse{Item: item}, nil
+}
+
+// SetTargetCredentialSources implements the interface pbs.TargetServiceServer.
+func (s Service) SetTargetCredentialSources(ctx context.Context, req *pbs.SetTargetCredentialSourcesRequest) (*pbs.SetTargetCredentialSourcesResponse, error) {
+	const op = "targets.(Service).SetTargetCredentialSources"
+
+	if err := validateSetCredentialSourcesRequest(req); err != nil {
+		return nil, err
+	}
+	authResults := s.authResult(ctx, req.GetId(), action.SetCredentialSources)
+	if authResults.Error != nil {
+		return nil, authResults.Error
+	}
+	t, ts, cl, err := s.setCredentialSourcesInRepo(ctx, req.GetId(), req.GetApplicationCredentialSourceIds(), req.GetVersion())
+	if err != nil {
+		return nil, err
+	}
+
+	outputFields, ok := requests.OutputFields(ctx)
+	if !ok {
+		return nil, errors.New(errors.Internal, op, "no request context found")
+	}
+
+	outputOpts := make([]handlers.Option, 0, 3)
+	outputOpts = append(outputOpts, handlers.WithOutputFields(&outputFields))
+	if outputFields.Has(globals.ScopeField) {
+		outputOpts = append(outputOpts, handlers.WithScope(authResults.Scope))
+	}
+	if outputFields.Has(globals.AuthorizedActionsField) {
+		outputOpts = append(outputOpts, handlers.WithAuthorizedActions(authResults.FetchActionSetForId(ctx, t.GetPublicId(), IdActions).Strings()))
+	}
+
+	item, err := toProto(ctx, t, ts, cl, outputOpts...)
+	if err != nil {
+		return nil, err
+	}
+
+	return &pbs.SetTargetCredentialSourcesResponse{Item: item}, nil
+}
+
+// RemoveTargetCredentialSources implements the interface pbs.TargetServiceServer.
+func (s Service) RemoveTargetCredentialSources(ctx context.Context, req *pbs.RemoveTargetCredentialSourcesRequest) (*pbs.RemoveTargetCredentialSourcesResponse, error) {
+	const op = "targets.(Service).RemoveTargetCredentialSources"
+
+	if err := validateRemoveCredentialSourcesRequest(req); err != nil {
+		return nil, err
+	}
+	authResults := s.authResult(ctx, req.GetId(), action.RemoveCredentialSources)
+	if authResults.Error != nil {
+		return nil, authResults.Error
+	}
+	t, ts, cl, err := s.removeCredentialSourcesInRepo(ctx, req.GetId(), req.GetApplicationCredentialSourceIds(), req.GetVersion())
+	if err != nil {
+		return nil, err
+	}
+
+	outputFields, ok := requests.OutputFields(ctx)
+	if !ok {
+		return nil, errors.New(errors.Internal, op, "no request context found")
+	}
+
+	outputOpts := make([]handlers.Option, 0, 3)
+	outputOpts = append(outputOpts, handlers.WithOutputFields(&outputFields))
+	if outputFields.Has(globals.ScopeField) {
+		outputOpts = append(outputOpts, handlers.WithScope(authResults.Scope))
+	}
+	if outputFields.Has(globals.AuthorizedActionsField) {
+		outputOpts = append(outputOpts, handlers.WithAuthorizedActions(authResults.FetchActionSetForId(ctx, t.GetPublicId(), IdActions).Strings()))
+	}
+
+	item, err := toProto(ctx, t, ts, cl, outputOpts...)
+	if err != nil {
+		return nil, err
+	}
+
+	return &pbs.RemoveTargetCredentialSourcesResponse{Item: item}, nil
+}
+
 func (s Service) AuthorizeSession(ctx context.Context, req *pbs.AuthorizeSessionRequest) (*pbs.AuthorizeSessionResponse, error) {
 	const op = "targets.(Service).AuthorizeSession"
 	if err := validateAuthorizeSessionRequest(req); err != nil {
@@ -785,10 +902,10 @@ HostSetIterationLoop:
 	var dynCreds []*session.DynamicCredential
 	for _, l := range libs {
 		reqs = append(reqs, credential.Request{
-			SourceId: l.GetCredentialLibraryId(),
-			Purpose:  credential.Purpose(l.GetCredentialPurpose()),
+			SourceId: l.Id(),
+			Purpose:  credential.Purpose(l.CredentialPurpose()),
 		})
-		dynCreds = append(dynCreds, session.NewDynamicCredential(l.GetCredentialLibraryId(), credential.Purpose(l.GetCredentialPurpose())))
+		dynCreds = append(dynCreds, session.NewDynamicCredential(l.Id(), credential.Purpose(l.CredentialPurpose())))
 	}
 
 	expTime := timestamppb.Now()
@@ -909,7 +1026,7 @@ HostSetIterationLoop:
 	return &pbs.AuthorizeSessionResponse{Item: ret}, nil
 }
 
-func (s Service) getFromRepo(ctx context.Context, id string) (target.Target, []*target.TargetSet, []*target.TargetLibrary, error) {
+func (s Service) getFromRepo(ctx context.Context, id string) (target.Target, []*target.TargetSet, []target.CredentialSource, error) {
 	repo, err := s.repoFn()
 	if err != nil {
 		return nil, nil, nil, err
@@ -927,7 +1044,7 @@ func (s Service) getFromRepo(ctx context.Context, id string) (target.Target, []*
 	return u, hs, cl, nil
 }
 
-func (s Service) createInRepo(ctx context.Context, item *pb.Target) (target.Target, []*target.TargetSet, []*target.TargetLibrary, error) {
+func (s Service) createInRepo(ctx context.Context, item *pb.Target) (target.Target, []*target.TargetSet, []target.CredentialSource, error) {
 	const op = "targets.(Service).createInRepo"
 	opts := []target.Option{target.WithName(item.GetName().GetValue())}
 	if item.GetDescription() != nil {
@@ -967,7 +1084,7 @@ func (s Service) createInRepo(ctx context.Context, item *pb.Target) (target.Targ
 	return out, hs, cl, nil
 }
 
-func (s Service) updateInRepo(ctx context.Context, scopeId, id string, mask []string, item *pb.Target) (target.Target, []*target.TargetSet, []*target.TargetLibrary, error) {
+func (s Service) updateInRepo(ctx context.Context, scopeId, id string, mask []string, item *pb.Target) (target.Target, []*target.TargetSet, []target.CredentialSource, error) {
 	const op = "targets.(Service).updateInRepo"
 	var opts []target.Option
 	if desc := item.GetDescription(); desc != nil {
@@ -1044,7 +1161,7 @@ func (s Service) listFromRepo(ctx context.Context, scopeIds []string) ([]target.
 	return ul, nil
 }
 
-func (s Service) addSetsInRepo(ctx context.Context, targetId string, hostSetId []string, version uint32) (target.Target, []*target.TargetSet, []*target.TargetLibrary, error) {
+func (s Service) addSetsInRepo(ctx context.Context, targetId string, hostSetId []string, version uint32) (target.Target, []*target.TargetSet, []target.CredentialSource, error) {
 	repo, err := s.repoFn()
 	if err != nil {
 		return nil, nil, nil, err
@@ -1060,7 +1177,7 @@ func (s Service) addSetsInRepo(ctx context.Context, targetId string, hostSetId [
 	return out, hs, cl, nil
 }
 
-func (s Service) setSetsInRepo(ctx context.Context, targetId string, hostSetIds []string, version uint32) (target.Target, []*target.TargetSet, []*target.TargetLibrary, error) {
+func (s Service) setSetsInRepo(ctx context.Context, targetId string, hostSetIds []string, version uint32) (target.Target, []*target.TargetSet, []target.CredentialSource, error) {
 	const op = "targets.(Service).setSetsInRepo"
 	repo, err := s.repoFn()
 	if err != nil {
@@ -1082,7 +1199,7 @@ func (s Service) setSetsInRepo(ctx context.Context, targetId string, hostSetIds
 	return out, hs, cl, nil
 }
 
-func (s Service) removeSetsInRepo(ctx context.Context, targetId string, hostSetIds []string, version uint32) (target.Target, []*target.TargetSet, []*target.TargetLibrary, error) {
+func (s Service) removeSetsInRepo(ctx context.Context, targetId string, hostSetIds []string, version uint32) (target.Target, []*target.TargetSet, []target.CredentialSource, error) {
 	const op = "targets.(Service).removeSetsInRepo"
 	repo, err := s.repoFn()
 	if err != nil {
@@ -1103,63 +1220,63 @@ func (s Service) removeSetsInRepo(ctx context.Context, targetId string, hostSetI
 	return out, hs, cl, nil
 }
 
-func (s Service) addLibrariesInRepo(ctx context.Context, targetId string, lids []string, version uint32) (target.Target, []*target.TargetSet, []*target.TargetLibrary, error) {
+func (s Service) addCredentialSourcesInRepo(ctx context.Context, targetId string, ids []string, version uint32) (target.Target, []*target.TargetSet, []target.CredentialSource, error) {
 	repo, err := s.repoFn()
 	if err != nil {
 		return nil, nil, nil, err
 	}
-	out, hs, cl, err := repo.AddTargetCredentialLibraries(ctx, targetId, version, strutil.RemoveDuplicates(lids, false))
+	out, hs, credSources, err := repo.AddTargetCredentialSources(ctx, targetId, version, strutil.RemoveDuplicates(ids, false))
 	if err != nil {
 		// TODO: Figure out a way to surface more helpful error info beyond the Internal error.
-		return nil, nil, nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to add credential libraries to target: %v.", err)
+		return nil, nil, nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to add credential sources to target: %v.", err)
 	}
 	if out == nil {
-		return nil, nil, nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to lookup target after adding credential libraries to it.")
+		return nil, nil, nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to lookup target after adding credential sources to it.")
 	}
-	return out, hs, cl, nil
+	return out, hs, credSources, nil
 }
 
-func (s Service) setLibrariesInRepo(ctx context.Context, targetId string, lids []string, version uint32) (target.Target, []*target.TargetSet, []*target.TargetLibrary, error) {
-	const op = "targets.(Service).setLibrariesInRepo"
+func (s Service) setCredentialSourcesInRepo(ctx context.Context, targetId string, ids []string, version uint32) (target.Target, []*target.TargetSet, []target.CredentialSource, error) {
+	const op = "targets.(Service).setCredentialSourcesInRepo"
 	repo, err := s.repoFn()
 	if err != nil {
 		return nil, nil, nil, err
 	}
-	_, _, _, err = repo.SetTargetCredentialLibraries(ctx, targetId, version, strutil.RemoveDuplicates(lids, false))
+	_, _, _, err = repo.SetTargetCredentialSources(ctx, targetId, version, strutil.RemoveDuplicates(ids, false))
 	if err != nil {
 		// TODO: Figure out a way to surface more helpful error info beyond the Internal error.
-		return nil, nil, nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to set credential libraries in target: %v.", err)
+		return nil, nil, nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to set credential sources in target: %v.", err)
 	}
 
-	out, hs, cl, err := repo.LookupTarget(ctx, targetId)
+	out, hs, credSources, err := repo.LookupTarget(ctx, targetId)
 	if err != nil {
-		return nil, nil, nil, errors.Wrap(err, op, errors.WithMsg("unable to look up target after setting credential libraries"))
+		return nil, nil, nil, errors.Wrap(err, op, errors.WithMsg("unable to look up target after setting credential sources"))
 	}
 	if out == nil {
-		return nil, nil, nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to lookup target after setting credential libraries for it.")
+		return nil, nil, nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to lookup target after setting credential sources for it.")
 	}
-	return out, hs, cl, nil
+	return out, hs, credSources, nil
 }
 
-func (s Service) removeLibrariesInRepo(ctx context.Context, targetId string, lids []string, version uint32) (target.Target, []*target.TargetSet, []*target.TargetLibrary, error) {
-	const op = "targets.(Service).removeLibrariesInRepo"
+func (s Service) removeCredentialSourcesInRepo(ctx context.Context, targetId string, ids []string, version uint32) (target.Target, []*target.TargetSet, []target.CredentialSource, error) {
+	const op = "targets.(Service).removeCredentialSourcesInRepo"
 	repo, err := s.repoFn()
 	if err != nil {
 		return nil, nil, nil, err
 	}
-	_, err = repo.DeleteTargetCredentialLibraries(ctx, targetId, version, strutil.RemoveDuplicates(lids, false))
+	_, err = repo.DeleteTargetCredentialSources(ctx, targetId, version, strutil.RemoveDuplicates(ids, false))
 	if err != nil {
 		// TODO: Figure out a way to surface more helpful error info beyond the Internal error.
-		return nil, nil, nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to remove credential libraries from target: %v.", err)
+		return nil, nil, nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to remove credential sources from target: %v.", err)
 	}
-	out, hs, cl, err := repo.LookupTarget(ctx, targetId)
+	out, hs, credSources, err := repo.LookupTarget(ctx, targetId)
 	if err != nil {
-		return nil, nil, nil, errors.Wrap(err, op, errors.WithMsg("unable to look up target after removing credential libraries"))
+		return nil, nil, nil, errors.Wrap(err, op, errors.WithMsg("unable to look up target after removing credential sources"))
 	}
 	if out == nil {
-		return nil, nil, nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to lookup target after removing credential libraries from it.")
+		return nil, nil, nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to lookup target after removing credential sources from it.")
 	}
-	return out, hs, cl, nil
+	return out, hs, credSources, nil
 }
 
 func (s Service) authResult(ctx context.Context, id string, a action.Type, lookupOpt ...target.Option) auth.VerifyResults {
@@ -1215,7 +1332,7 @@ func (s Service) authResult(ctx context.Context, id string, a action.Type, looku
 	return ret
 }
 
-func toProto(ctx context.Context, in target.Target, m []*target.TargetSet, l []*target.TargetLibrary, opt ...handlers.Option) (*pb.Target, error) {
+func toProto(ctx context.Context, in target.Target, m []*target.TargetSet, credSources []target.CredentialSource, opt ...handlers.Option) (*pb.Target, error) {
 	const op = "target_service.toProto"
 	opts := handlers.GetOpts(opt...)
 	if opts.WithOutputFields == nil {
@@ -1277,22 +1394,42 @@ func toProto(ctx context.Context, in target.Target, m []*target.TargetSet, l []*
 		}
 	}
 	if outputFields.Has(globals.ApplicationCredentialLibraryIdsField) {
-		for _, cl := range l {
-			out.ApplicationCredentialLibraryIds = append(out.ApplicationCredentialLibraryIds, cl.GetCredentialLibraryId())
+		for _, cs := range credSources {
+			out.ApplicationCredentialLibraryIds = append(out.ApplicationCredentialLibraryIds, cs.Id())
+		}
+	}
+	if outputFields.Has(globals.ApplicationCredentialSourceIdsField) {
+		for _, cs := range credSources {
+			out.ApplicationCredentialSourceIds = append(out.ApplicationCredentialSourceIds, cs.Id())
 		}
 	}
 	if outputFields.Has(globals.ApplicationCredentialLibrariesField) {
-		for _, cl := range l {
-			switch credential.Purpose(cl.GetCredentialPurpose()) {
+		for _, cs := range credSources {
+			switch credential.Purpose(cs.CredentialPurpose()) {
 			case credential.ApplicationPurpose:
 				out.ApplicationCredentialLibraries = append(out.ApplicationCredentialLibraries, &pb.CredentialLibrary{
-					Id:                cl.GetCredentialLibraryId(),
-					CredentialStoreId: cl.StoreId,
+					Id:                cs.Id(),
+					CredentialStoreId: cs.CredentialStoreId(),
 				})
 			case credential.IngressPurpose, credential.EgressPurpose:
 				// TODO: When we support other purposes add them to different fields here.
 			default:
-				return nil, errors.New(errors.Internal, op, fmt.Sprintf("unrecognized purpose %q for credential library on target", cl.GetCredentialPurpose()))
+				return nil, errors.New(errors.Internal, op, fmt.Sprintf("unrecognized purpose %q for credential source on target", cs.CredentialPurpose()))
+			}
+		}
+	}
+	if outputFields.Has(globals.ApplicationCredentialSourcesField) {
+		for _, cs := range credSources {
+			switch credential.Purpose(cs.CredentialPurpose()) {
+			case credential.ApplicationPurpose:
+				out.ApplicationCredentialSources = append(out.ApplicationCredentialSources, &pb.CredentialSource{
+					Id:                cs.Id(),
+					CredentialStoreId: cs.CredentialStoreId(),
+				})
+			case credential.IngressPurpose, credential.EgressPurpose:
+				// TODO: When we support other purposes add them to different fields here.
+			default:
+				return nil, errors.New(errors.Internal, op, fmt.Sprintf("unrecognized purpose %q for credential source on target", cs.CredentialPurpose()))
 			}
 		}
 	}
@@ -1557,6 +1694,72 @@ func validateRemoveLibrariesRequest(req *pbs.RemoveTargetCredentialLibrariesRequ
 	return nil
 }
 
+func validateAddCredentialSourcesRequest(req *pbs.AddTargetCredentialSourcesRequest) error {
+	badFields := map[string]string{}
+	if !handlers.ValidId(handlers.Id(req.GetId()), target.TcpTargetPrefix) {
+		badFields[globals.IdField] = "Incorrectly formatted identifier."
+	}
+	if req.GetVersion() == 0 {
+		badFields[globals.VersionField] = "Required field."
+	}
+	if len(req.GetApplicationCredentialSourceIds()) == 0 {
+		badFields[globals.ApplicationCredentialSourceIdsField] = "Must be non-empty."
+	}
+	for _, cl := range req.GetApplicationCredentialSourceIds() {
+		if !handlers.ValidId(handlers.Id(cl), vault.CredentialLibraryPrefix) {
+			badFields[globals.ApplicationCredentialSourceIdsField] = fmt.Sprintf("Incorrectly formatted credential source identifier %q.", cl)
+			break
+		}
+	}
+	if len(badFields) > 0 {
+		return handlers.InvalidArgumentErrorf("Errors in provided fields.", badFields)
+	}
+	return nil
+}
+
+func validateSetCredentialSourcesRequest(req *pbs.SetTargetCredentialSourcesRequest) error {
+	badFields := map[string]string{}
+	if !handlers.ValidId(handlers.Id(req.GetId()), target.TcpTargetPrefix) {
+		badFields[globals.IdField] = "Incorrectly formatted identifier."
+	}
+	if req.GetVersion() == 0 {
+		badFields[globals.VersionField] = "Required field."
+	}
+	for _, cl := range req.GetApplicationCredentialSourceIds() {
+		if !handlers.ValidId(handlers.Id(cl), vault.CredentialLibraryPrefix) {
+			badFields[globals.ApplicationCredentialSourceIdsField] = fmt.Sprintf("Incorrectly formatted credential source identifier %q.", cl)
+			break
+		}
+	}
+	if len(badFields) > 0 {
+		return handlers.InvalidArgumentErrorf("Errors in provided fields.", badFields)
+	}
+	return nil
+}
+
+func validateRemoveCredentialSourcesRequest(req *pbs.RemoveTargetCredentialSourcesRequest) error {
+	badFields := map[string]string{}
+	if !handlers.ValidId(handlers.Id(req.GetId()), target.TcpTargetPrefix) {
+		badFields[globals.IdField] = "Incorrectly formatted identifier."
+	}
+	if req.GetVersion() == 0 {
+		badFields[globals.VersionField] = "Required field."
+	}
+	if len(req.GetApplicationCredentialSourceIds()) == 0 {
+		badFields[globals.ApplicationCredentialLibraryIdsField] = "Must be non-empty."
+	}
+	for _, cl := range req.GetApplicationCredentialSourceIds() {
+		if !handlers.ValidId(handlers.Id(cl), vault.CredentialLibraryPrefix) {
+			badFields[globals.ApplicationCredentialSourceIdsField] = fmt.Sprintf("Incorrectly formatted credential source identifier %q.", cl)
+			break
+		}
+	}
+	if len(badFields) > 0 {
+		return handlers.InvalidArgumentErrorf("Errors in provided fields.", badFields)
+	}
+	return nil
+}
+
 func validateAuthorizeSessionRequest(req *pbs.AuthorizeSessionRequest) error {
 	badFields := map[string]string{}
 	nameEmpty := req.GetName() == ""

internal/servers/controller/handlers/targets/target_service_test.go

@@ -63,6 +63,9 @@ var testAuthorizedActions = []string{
 	"add-credential-libraries",
 	"set-credential-libraries",
 	"remove-credential-libraries",
+	"add-credential-sources",
+	"set-credential-sources",
+	"remove-credential-sources",
 	"authorize-session",
 }
 
@@ -1329,13 +1332,13 @@ func TestAddTargetLibraries(t *testing.T) {
 		},
 		{
 			name:             "Add library on populated target",
-			tar:              target.TestTcpTarget(t, conn, proj.GetPublicId(), "populated for libraries", target.WithCredentialLibraries([]string{cls[0].GetPublicId()})),
+			tar:              target.TestTcpTarget(t, conn, proj.GetPublicId(), "populated for libraries", target.WithCredentialSources([]string{cls[0].GetPublicId()})),
 			addLibraries:     []string{cls[1].GetPublicId()},
 			resultLibraryIds: []string{cls[0].GetPublicId(), cls[1].GetPublicId()},
 		},
 		{
 			name:             "Add duplicated libraries on populated target",
-			tar:              target.TestTcpTarget(t, conn, proj.GetPublicId(), "duplicated for libraries", target.WithCredentialLibraries([]string{cls[0].GetPublicId()})),
+			tar:              target.TestTcpTarget(t, conn, proj.GetPublicId(), "duplicated for libraries", target.WithCredentialSources([]string{cls[0].GetPublicId()})),
 			addLibraries:     []string{cls[1].GetPublicId(), cls[1].GetPublicId()},
 			resultLibraryIds: []string{cls[0].GetPublicId(), cls[1].GetPublicId()},
 		},
@@ -1465,19 +1468,19 @@ func TestSetTargetLibraries(t *testing.T) {
 		},
 		{
 			name:             "Set on populated target",
-			tar:              target.TestTcpTarget(t, conn, proj.GetPublicId(), "populated", target.WithCredentialLibraries([]string{cls[0].GetPublicId()})),
+			tar:              target.TestTcpTarget(t, conn, proj.GetPublicId(), "populated", target.WithCredentialSources([]string{cls[0].GetPublicId()})),
 			setLibraries:     []string{cls[1].GetPublicId()},
 			resultLibraryIds: []string{cls[1].GetPublicId()},
 		},
 		{
 			name:             "Set duplicate libraries on populated target",
-			tar:              target.TestTcpTarget(t, conn, proj.GetPublicId(), "duplicate", target.WithCredentialLibraries([]string{cls[0].GetPublicId()})),
+			tar:              target.TestTcpTarget(t, conn, proj.GetPublicId(), "duplicate", target.WithCredentialSources([]string{cls[0].GetPublicId()})),
 			setLibraries:     []string{cls[1].GetPublicId(), cls[1].GetPublicId()},
 			resultLibraryIds: []string{cls[1].GetPublicId()},
 		},
 		{
 			name:             "Set empty on populated target",
-			tar:              target.TestTcpTarget(t, conn, proj.GetPublicId(), "another populated", target.WithCredentialLibraries([]string{cls[0].GetPublicId()})),
+			tar:              target.TestTcpTarget(t, conn, proj.GetPublicId(), "another populated", target.WithCredentialSources([]string{cls[0].GetPublicId()})),
 			setLibraries:     []string{},
 			resultLibraryIds: nil,
 		},
@@ -1591,13 +1594,13 @@ func TestRemoveTargetLibraries(t *testing.T) {
 		},
 		{
 			name:         "Remove 1 of 2 libraries",
-			tar:          target.TestTcpTarget(t, conn, proj.GetPublicId(), "remove partial", target.WithCredentialLibraries([]string{cls[0].GetPublicId(), cls[1].GetPublicId()})),
+			tar:          target.TestTcpTarget(t, conn, proj.GetPublicId(), "remove partial", target.WithCredentialSources([]string{cls[0].GetPublicId(), cls[1].GetPublicId()})),
 			removeLibs:   []string{cls[1].GetPublicId()},
 			resultLibIds: []string{cls[0].GetPublicId()},
 		},
 		{
 			name: "Remove 1 duplicate set of 2 libraries",
-			tar:  target.TestTcpTarget(t, conn, proj.GetPublicId(), "remove duplicate", target.WithCredentialLibraries([]string{cls[0].GetPublicId(), cls[1].GetPublicId()})),
+			tar:  target.TestTcpTarget(t, conn, proj.GetPublicId(), "remove duplicate", target.WithCredentialSources([]string{cls[0].GetPublicId(), cls[1].GetPublicId()})),
 			removeLibs: []string{
 				cls[1].GetPublicId(), cls[1].GetPublicId(),
 			},
@@ -1605,7 +1608,7 @@ func TestRemoveTargetLibraries(t *testing.T) {
 		},
 		{
 			name: "Remove all libraries from target",
-			tar:  target.TestTcpTarget(t, conn, proj.GetPublicId(), "remove all", target.WithCredentialLibraries([]string{cls[0].GetPublicId(), cls[1].GetPublicId()})),
+			tar:  target.TestTcpTarget(t, conn, proj.GetPublicId(), "remove all", target.WithCredentialSources([]string{cls[0].GetPublicId(), cls[1].GetPublicId()})),
 			removeLibs: []string{
 				cls[0].GetPublicId(), cls[1].GetPublicId(),
 			},
@@ -1694,6 +1697,403 @@ func TestRemoveTargetLibraries(t *testing.T) {
 	}
 }
 
+func TestAddTargetSources(t *testing.T) {
+	conn, _ := db.TestSetup(t, "postgres")
+	wrapper := db.TestWrapper(t)
+	kms := kms.TestKms(t, conn, wrapper)
+
+	iamRepo := iam.TestRepo(t, conn, wrapper)
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iamRepo, nil
+	}
+
+	_, proj := iam.TestScopes(t, iamRepo)
+
+	s, err := testService(t, conn, kms, wrapper)
+	require.NoError(t, err, "Error when getting new target service.")
+
+	store := vault.TestCredentialStores(t, conn, wrapper, proj.GetPublicId(), 1)[0]
+	cls := vault.TestCredentialLibraries(t, conn, wrapper, store.GetPublicId(), 2)
+
+	addCases := []struct {
+		name            string
+		tar             *target.TcpTarget
+		addSources      []string
+		resultSourceIds []string
+	}{
+		{
+			name:            "Add source on empty target",
+			tar:             target.TestTcpTarget(t, conn, proj.GetPublicId(), "empty for sources"),
+			addSources:      []string{cls[1].GetPublicId()},
+			resultSourceIds: []string{cls[1].GetPublicId()},
+		},
+		{
+			name:            "Add source on populated target",
+			tar:             target.TestTcpTarget(t, conn, proj.GetPublicId(), "populated for sources", target.WithCredentialSources([]string{cls[0].GetPublicId()})),
+			addSources:      []string{cls[1].GetPublicId()},
+			resultSourceIds: []string{cls[0].GetPublicId(), cls[1].GetPublicId()},
+		},
+		{
+			name:            "Add duplicated sources on populated target",
+			tar:             target.TestTcpTarget(t, conn, proj.GetPublicId(), "duplicated for sources", target.WithCredentialSources([]string{cls[0].GetPublicId()})),
+			addSources:      []string{cls[1].GetPublicId(), cls[1].GetPublicId()},
+			resultSourceIds: []string{cls[0].GetPublicId(), cls[1].GetPublicId()},
+		},
+	}
+
+	for _, tc := range addCases {
+		t.Run(tc.name, func(t *testing.T) {
+			req := &pbs.AddTargetCredentialSourcesRequest{
+				Id:                             tc.tar.GetPublicId(),
+				Version:                        tc.tar.GetVersion(),
+				ApplicationCredentialSourceIds: tc.addSources,
+			}
+
+			got, err := s.AddTargetCredentialSources(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), req)
+			require.NoError(t, err, "Got error: %v", s)
+
+			assert.ElementsMatch(t, tc.resultSourceIds, got.GetItem().GetApplicationCredentialSourceIds())
+
+			assert.Equal(t, len(tc.resultSourceIds), len(got.GetItem().GetApplicationCredentialSources()))
+
+			wantTemplate := &pb.CredentialSource{
+				CredentialStoreId: store.GetPublicId(),
+			}
+			for _, cl := range got.GetItem().GetApplicationCredentialSources() {
+				cl.Id = ""
+				assert.Empty(t, cmp.Diff(wantTemplate, cl, protocmp.Transform()))
+			}
+		})
+	}
+
+	tar := target.TestTcpTarget(t, conn, proj.GetPublicId(), "test")
+
+	failCases := []struct {
+		name string
+		req  *pbs.AddTargetCredentialSourcesRequest
+		err  error
+	}{
+		{
+			name: "Bad target id",
+			req: &pbs.AddTargetCredentialSourcesRequest{
+				Id:      "bad id",
+				Version: tar.GetVersion(),
+				ApplicationCredentialSourceIds: []string{
+					cls[0].GetPublicId(),
+				},
+			},
+			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
+		},
+		{
+			name: "Bad version",
+			req: &pbs.AddTargetCredentialSourcesRequest{
+				Id:      tar.GetPublicId(),
+				Version: tar.GetVersion() + 2,
+				ApplicationCredentialSourceIds: []string{
+					cls[0].GetPublicId(),
+				},
+			},
+			err: handlers.ApiErrorWithCode(codes.Internal),
+		},
+		{
+			name: "Empty source list",
+			req: &pbs.AddTargetCredentialSourcesRequest{
+				Id:      tar.GetPublicId(),
+				Version: tar.GetVersion(),
+			},
+			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
+		},
+		{
+			name: "Incorrect source id",
+			req: &pbs.AddTargetCredentialSourcesRequest{
+				Id:                             tar.GetPublicId(),
+				Version:                        tar.GetVersion(),
+				ApplicationCredentialSourceIds: []string{"incorrect"},
+			},
+			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
+		},
+	}
+	for _, tc := range failCases {
+		t.Run(tc.name, func(t *testing.T) {
+			assert, require := assert.New(t), require.New(t)
+			_, gErr := s.AddTargetCredentialSources(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), tc.req)
+			if tc.err != nil {
+				require.Error(gErr)
+				assert.True(errors.Is(gErr, tc.err), "AddTargetCredentialSources(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
+			}
+		})
+	}
+}
+
+func TestSetTargetCredentialSources(t *testing.T) {
+	conn, _ := db.TestSetup(t, "postgres")
+	wrapper := db.TestWrapper(t)
+	kms := kms.TestKms(t, conn, wrapper)
+
+	iamRepo := iam.TestRepo(t, conn, wrapper)
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iamRepo, nil
+	}
+
+	_, proj := iam.TestScopes(t, iamRepo)
+
+	s, err := testService(t, conn, kms, wrapper)
+	require.NoError(t, err, "Error when getting new target service.")
+
+	store := vault.TestCredentialStores(t, conn, wrapper, proj.GetPublicId(), 1)[0]
+	cls := vault.TestCredentialLibraries(t, conn, wrapper, store.GetPublicId(), 2)
+
+	resultingTargetSource := func(id string) *pb.CredentialSource {
+		return &pb.CredentialSource{
+			Id:                id,
+			CredentialStoreId: store.GetPublicId(),
+		}
+	}
+
+	setCases := []struct {
+		name                      string
+		tar                       *target.TcpTarget
+		setCredentialSources      []string
+		resultCredentialSourceIds []string
+		resultCredentialSources   []*pb.CredentialLibrary
+	}{
+		{
+			name:                      "Set on empty target",
+			tar:                       target.TestTcpTarget(t, conn, proj.GetPublicId(), "empty"),
+			setCredentialSources:      []string{cls[1].GetPublicId()},
+			resultCredentialSourceIds: []string{cls[1].GetPublicId()},
+		},
+		{
+			name:                      "Set on populated target",
+			tar:                       target.TestTcpTarget(t, conn, proj.GetPublicId(), "populated", target.WithCredentialSources([]string{cls[0].GetPublicId()})),
+			setCredentialSources:      []string{cls[1].GetPublicId()},
+			resultCredentialSourceIds: []string{cls[1].GetPublicId()},
+		},
+		{
+			name:                      "Set duplicate sources on populated target",
+			tar:                       target.TestTcpTarget(t, conn, proj.GetPublicId(), "duplicate", target.WithCredentialSources([]string{cls[0].GetPublicId()})),
+			setCredentialSources:      []string{cls[1].GetPublicId(), cls[1].GetPublicId()},
+			resultCredentialSourceIds: []string{cls[1].GetPublicId()},
+		},
+		{
+			name:                      "Set empty on populated target",
+			tar:                       target.TestTcpTarget(t, conn, proj.GetPublicId(), "another populated", target.WithCredentialSources([]string{cls[0].GetPublicId()})),
+			setCredentialSources:      []string{},
+			resultCredentialSourceIds: nil,
+		},
+	}
+	for _, tc := range setCases {
+		t.Run(tc.name, func(t *testing.T) {
+			req := &pbs.SetTargetCredentialSourcesRequest{
+				Id:                             tc.tar.GetPublicId(),
+				Version:                        tc.tar.GetVersion(),
+				ApplicationCredentialSourceIds: tc.setCredentialSources,
+			}
+
+			got, err := s.SetTargetCredentialSources(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), req)
+			require.NoError(t, err, "Got error: %v", s)
+			assert.ElementsMatch(t, tc.resultCredentialSourceIds, got.GetItem().GetApplicationCredentialSourceIds())
+
+			if len(tc.resultCredentialSources) != 0 {
+				sort.Slice(tc.resultCredentialSources, func(i, j int) bool {
+					return tc.resultCredentialSources[i].GetId() < tc.resultCredentialSources[j].GetId()
+				})
+				sort.Slice(got.GetItem().ApplicationCredentialSourceIds, func(i, j int) bool {
+					return got.GetItem().ApplicationCredentialSourceIds[i] < got.GetItem().ApplicationCredentialSourceIds[j]
+				})
+				assert.Empty(t, cmp.Diff(tc.resultCredentialSources, got.GetItem().GetApplicationCredentialSourceIds(), protocmp.Transform()))
+			} else {
+				assert.Equal(t, len(tc.resultCredentialSourceIds), len(got.GetItem().GetApplicationCredentialSourceIds()))
+				for _, cl := range got.GetItem().GetApplicationCredentialSources() {
+					assert.Empty(t, cmp.Diff(resultingTargetSource(cl.GetId()), cl, protocmp.Transform()))
+				}
+			}
+		})
+	}
+
+	tar := target.TestTcpTarget(t, conn, proj.GetPublicId(), "test name")
+
+	failCases := []struct {
+		name string
+		req  *pbs.SetTargetCredentialSourcesRequest
+		err  error
+	}{
+		{
+			name: "Bad target Id",
+			req: &pbs.SetTargetCredentialSourcesRequest{
+				Id:                             "bad id",
+				Version:                        tar.GetVersion(),
+				ApplicationCredentialSourceIds: []string{cls[0].GetPublicId()},
+			},
+			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
+		},
+		{
+			name: "Bad version",
+			req: &pbs.SetTargetCredentialSourcesRequest{
+				Id:                             tar.GetPublicId(),
+				Version:                        tar.GetVersion() + 3,
+				ApplicationCredentialSourceIds: []string{cls[0].GetPublicId()},
+			},
+			err: handlers.ApiErrorWithCode(codes.Internal),
+		},
+		{
+			name: "Bad source id",
+			req: &pbs.SetTargetCredentialSourcesRequest{
+				Id:                             tar.GetPublicId(),
+				Version:                        tar.GetVersion(),
+				ApplicationCredentialSourceIds: []string{"invalid"},
+			},
+			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
+		},
+	}
+	for _, tc := range failCases {
+		t.Run(tc.name, func(t *testing.T) {
+			assert, require := assert.New(t), require.New(t)
+			_, gErr := s.SetTargetCredentialSources(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), tc.req)
+			if tc.err != nil {
+				require.Error(gErr)
+				assert.True(errors.Is(gErr, tc.err), "SetTargetCredentialSources(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
+			}
+		})
+	}
+}
+
+func TestRemoveTargetCredentialSources(t *testing.T) {
+	conn, _ := db.TestSetup(t, "postgres")
+	wrapper := db.TestWrapper(t)
+	kms := kms.TestKms(t, conn, wrapper)
+
+	iamRepo := iam.TestRepo(t, conn, wrapper)
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iamRepo, nil
+	}
+
+	_, proj := iam.TestScopes(t, iamRepo)
+
+	s, err := testService(t, conn, kms, wrapper)
+	require.NoError(t, err, "Error when getting new target service.")
+
+	store := vault.TestCredentialStores(t, conn, wrapper, proj.GetPublicId(), 1)[0]
+	cls := vault.TestCredentialLibraries(t, conn, wrapper, store.GetPublicId(), 2)
+
+	removeCases := []struct {
+		name                      string
+		tar                       *target.TcpTarget
+		removeCredentialSources   []string
+		resultCredentialSourceIds []string
+		wantErr                   bool
+	}{
+		{
+			name:                    "Remove from empty",
+			tar:                     target.TestTcpTarget(t, conn, proj.GetPublicId(), "empty"),
+			removeCredentialSources: []string{cls[1].GetPublicId()},
+			wantErr:                 true,
+		},
+		{
+			name:                      "Remove 1 of 2 sources",
+			tar:                       target.TestTcpTarget(t, conn, proj.GetPublicId(), "remove partial", target.WithCredentialSources([]string{cls[0].GetPublicId(), cls[1].GetPublicId()})),
+			removeCredentialSources:   []string{cls[1].GetPublicId()},
+			resultCredentialSourceIds: []string{cls[0].GetPublicId()},
+		},
+		{
+			name: "Remove 1 duplicate set of 2 sources",
+			tar:  target.TestTcpTarget(t, conn, proj.GetPublicId(), "remove duplicate", target.WithCredentialSources([]string{cls[0].GetPublicId(), cls[1].GetPublicId()})),
+			removeCredentialSources: []string{
+				cls[1].GetPublicId(), cls[1].GetPublicId(),
+			},
+			resultCredentialSourceIds: []string{cls[0].GetPublicId()},
+		},
+		{
+			name: "Remove all sources from target",
+			tar:  target.TestTcpTarget(t, conn, proj.GetPublicId(), "remove all", target.WithCredentialSources([]string{cls[0].GetPublicId(), cls[1].GetPublicId()})),
+			removeCredentialSources: []string{
+				cls[0].GetPublicId(), cls[1].GetPublicId(),
+			},
+			resultCredentialSourceIds: []string{},
+		},
+	}
+
+	for _, tc := range removeCases {
+		t.Run(tc.name, func(t *testing.T) {
+			req := &pbs.RemoveTargetCredentialSourcesRequest{
+				Id:                             tc.tar.GetPublicId(),
+				Version:                        tc.tar.GetVersion(),
+				ApplicationCredentialSourceIds: tc.removeCredentialSources,
+			}
+
+			got, err := s.RemoveTargetCredentialSources(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), req)
+			if tc.wantErr {
+				assert.Error(t, err)
+				return
+			}
+			require.NoError(t, err, "Got error: %v", s)
+
+			assert.ElementsMatch(t, tc.resultCredentialSourceIds, got.GetItem().GetApplicationCredentialSourceIds())
+		})
+	}
+
+	tar := target.TestTcpTarget(t, conn, proj.GetPublicId(), "testing")
+
+	failCases := []struct {
+		name string
+		req  *pbs.RemoveTargetCredentialSourcesRequest
+		err  error
+	}{
+		{
+			name: "Bad version",
+			req: &pbs.RemoveTargetCredentialSourcesRequest{
+				Id:      tar.GetPublicId(),
+				Version: tar.GetVersion() + 3,
+				ApplicationCredentialSourceIds: []string{
+					cls[0].GetPublicId(),
+				},
+			},
+			err: handlers.ApiErrorWithCode(codes.Internal),
+		},
+		{
+			name: "Bad target Id",
+			req: &pbs.RemoveTargetCredentialSourcesRequest{
+				Id:      "bad id",
+				Version: tar.GetVersion(),
+				ApplicationCredentialSourceIds: []string{
+					cls[0].GetPublicId(),
+				},
+			},
+			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
+		},
+		{
+			name: "Empty sources",
+			req: &pbs.RemoveTargetCredentialSourcesRequest{
+				Id:                             tar.GetPublicId(),
+				Version:                        tar.GetVersion(),
+				ApplicationCredentialSourceIds: []string{},
+			},
+			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
+		},
+		{
+			name: "Invalid source ids",
+			req: &pbs.RemoveTargetCredentialSourcesRequest{
+				Id:      tar.GetPublicId(),
+				Version: tar.GetVersion(),
+				ApplicationCredentialSourceIds: []string{
+					"invalid",
+				},
+			},
+			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
+		},
+	}
+	for _, tc := range failCases {
+		t.Run(tc.name, func(t *testing.T) {
+			assert, require := assert.New(t), require.New(t)
+			_, gErr := s.RemoveTargetCredentialSources(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), tc.req)
+			if tc.err != nil {
+				require.Error(gErr)
+				assert.True(errors.Is(gErr, tc.err), "RemoveTargetCredentialSources(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
+			}
+		})
+	}
+}
+
 func TestAuthorizeSession(t *testing.T) {
 	conn, _ := db.TestSetup(t, "postgres")
 	rw := db.New(conn)

internal/session/repository_session_test.go

@@ -1658,7 +1658,7 @@ func testSessionCredentialParams(t *testing.T, conn *gorm.DB, wrapper wrapping.W
 	tcpTarget, _, _, err := targetRepo.LookupTarget(ctx, params.TargetId)
 	require.NoError(err)
 	require.NotNil(tcpTarget)
-	_, _, _, err = targetRepo.AddTargetCredentialLibraries(ctx, tcpTarget.GetPublicId(), tcpTarget.GetVersion(), []string{libs[0].PublicId, libs[1].PublicId})
+	_, _, _, err = targetRepo.AddTargetCredentialSources(ctx, tcpTarget.GetPublicId(), tcpTarget.GetVersion(), []string{libs[0].PublicId, libs[1].PublicId})
 	require.NoError(err)
 	creds := []*DynamicCredential{
 		NewDynamicCredential(libs[0].GetPublicId(), credential.ApplicationPurpose),

internal/target/credential_library.go

@@ -10,8 +10,10 @@ import (
 	"google.golang.org/protobuf/proto"
 )
 
-// A CredentialLibrary represents the relationship between a target
-// and a credential library.
+var _ CredentialSource = (*TargetLibrary)(nil)
+
+// A CredentialLibrary is a CredentialSource that represents the relationship
+// between a target and a credential library.
 type CredentialLibrary struct {
 	*store.CredentialLibrary
 	tableName string `gorm:"-"`
@@ -76,6 +78,8 @@ func (t *CredentialLibrary) oplog(op oplog.OpType) oplog.Metadata {
 // A TargetLibrary represents the relationship between a target and a
 // credential library and includes the id of the credential store that the
 // library is a part of and the library's name and description.
+//
+// It implements the target.CredentialSource interface.
 type TargetLibrary struct {
 	*store.CredentialLibrary
 	StoreId string
@@ -85,3 +89,23 @@ type TargetLibrary struct {
 func (ts *TargetLibrary) TableName() string {
 	return "target_library"
 }
+
+// Id returns the ID of the library
+func (ts *TargetLibrary) Id() string {
+	return ts.CredentialLibraryId
+}
+
+// CredentialStoreId returns the ID of the store containing the library
+func (ts *TargetLibrary) CredentialStoreId() string {
+	return ts.StoreId
+}
+
+// CredentialPurpose returns the purpose of the credential
+func (ts *TargetLibrary) CredentialPurpose() credential.Purpose {
+	return credential.Purpose(ts.GetCredentialPurpose())
+}
+
+// TargetId returns the target linked to this credential source
+func (ts *TargetLibrary) TargetId() string {
+	return ts.GetTargetId()
+}

internal/target/credential_source.go

@@ -0,0 +1,12 @@
+package target
+
+import "github.com/hashicorp/boundary/internal/credential"
+
+// CredentialSource is an interface that can be implemented by both a library
+// and a singular credential.
+type CredentialSource interface {
+	CredentialStoreId() string
+	Id() string
+	CredentialPurpose() credential.Purpose
+	TargetId() string
+}

internal/target/options.go

@@ -26,7 +26,7 @@ type options struct {
 	withUserId                 string
 	withTargetType             *TargetType
 	withHostSets               []string
-	withCredentialLibraries    []string
+	withCredentialSources      []string
 	withSessionMaxSeconds      uint32
 	withSessionConnectionLimit int32
 	withPublicId               string
@@ -45,7 +45,7 @@ func getDefaultOptions() options {
 		withUserId:                 "",
 		withTargetType:             nil,
 		withHostSets:               nil,
-		withCredentialLibraries:    nil,
+		withCredentialSources:      nil,
 		withSessionMaxSeconds:      uint32((8 * time.Hour).Seconds()),
 		withSessionConnectionLimit: 1,
 		withPublicId:               "",
@@ -125,10 +125,10 @@ func WithHostSets(hs []string) Option {
 	}
 }
 
-// WithCredentialLibraries provides an option for providing a list of credential library ids
-func WithCredentialLibraries(cl []string) Option {
+// WithCredentialSources provides an option for providing a list of credential source ids
+func WithCredentialSources(cl []string) Option {
 	return func(o *options) {
-		o.withCredentialLibraries = cl
+		o.withCredentialSources = cl
 	}
 }
 

internal/target/options_test.go

@@ -104,11 +104,11 @@ func Test_GetOpts(t *testing.T) {
 		testOpts.withWorkerFilter = `"/foo" == "bar"`
 		assert.Equal(opts, testOpts)
 	})
-	t.Run("WithCredentialLibraries", func(t *testing.T) {
+	t.Run("WithCredentialSources", func(t *testing.T) {
 		assert := assert.New(t)
-		opts := getOpts(WithCredentialLibraries([]string{"alice", "bob"}))
+		opts := getOpts(WithCredentialSources([]string{"alice", "bob"}))
 		testOpts := getDefaultOptions()
-		testOpts.withCredentialLibraries = []string{"alice", "bob"}
+		testOpts.withCredentialSources = []string{"alice", "bob"}
 		assert.Equal(opts, testOpts)
 	})
 }

internal/target/repository.go

@@ -53,10 +53,10 @@ func NewRepository(r db.Reader, w db.Writer, kms *kms.Kms, opt ...Option) (*Repo
 }
 
 // LookupTarget will look up a target in the repository and return the target
-// with its host set ids and credential library ids.  If the target is not found,
+// with its host set ids and credential source ids.  If the target is not found,
 // it will return nil, nil, nil, nil.
 // No options are currently supported.
-func (r *Repository) LookupTarget(ctx context.Context, publicIdOrName string, opt ...Option) (Target, []*TargetSet, []*TargetLibrary, error) {
+func (r *Repository) LookupTarget(ctx context.Context, publicIdOrName string, opt ...Option) (Target, []*TargetSet, []CredentialSource, error) {
 	const op = "target.(Repository).LookupTarget"
 	opts := getOpts(opt...)
 
@@ -98,7 +98,7 @@ func (r *Repository) LookupTarget(ctx context.Context, publicIdOrName string, op
 	target := allocTargetView()
 	target.PublicId = publicIdOrName
 	var hostSets []*TargetSet
-	var credLibs []*TargetLibrary
+	var credSources []CredentialSource
 	_, err := r.writer.DoTx(
 		ctx,
 		db.StdRetryCnt,
@@ -119,7 +119,7 @@ func (r *Repository) LookupTarget(ctx context.Context, publicIdOrName string, op
 			if hostSets, err = fetchSets(ctx, read, target.PublicId); err != nil {
 				return errors.Wrap(err, op)
 			}
-			if credLibs, err = fetchLibraries(ctx, read, target.PublicId); err != nil {
+			if credSources, err = fetchCredentialSources(ctx, read, target.PublicId); err != nil {
 				return errors.Wrap(err, op)
 			}
 			return nil
@@ -135,7 +135,7 @@ func (r *Repository) LookupTarget(ctx context.Context, publicIdOrName string, op
 	if err != nil {
 		return nil, nil, nil, errors.Wrap(err, op)
 	}
-	return subtype, hostSets, credLibs, nil
+	return subtype, hostSets, credSources, nil
 }
 
 // ListTargets in targets in a scope.  Supports the WithScopeId, WithLimit, WithTargetType options.
@@ -250,7 +250,7 @@ func (r *Repository) DeleteTarget(ctx context.Context, publicId string, _ ...Opt
 
 // update a target in the db repository with an oplog entry.
 // It currently supports no options.
-func (r *Repository) update(ctx context.Context, target Target, version uint32, fieldMaskPaths []string, setToNullPaths []string, _ ...Option) (Target, []*TargetSet, []*TargetLibrary, int, error) {
+func (r *Repository) update(ctx context.Context, target Target, version uint32, fieldMaskPaths []string, setToNullPaths []string, _ ...Option) (Target, []*TargetSet, []CredentialSource, int, error) {
 	const op = "target.(Repository).update"
 	if version == 0 {
 		return nil, nil, nil, db.NoRowsAffected, errors.New(errors.InvalidParameter, op, "missing version")
@@ -284,7 +284,7 @@ func (r *Repository) update(ctx context.Context, target Target, version uint32,
 	var rowsUpdated int
 	var returnedTarget interface{}
 	var hostSets []*TargetSet
-	var credLibs []*TargetLibrary
+	var credSources []CredentialSource
 	_, err = r.writer.DoTx(
 		ctx,
 		db.StdRetryCnt,
@@ -310,7 +310,7 @@ func (r *Repository) update(ctx context.Context, target Target, version uint32,
 				return errors.Wrap(err, op)
 			}
 
-			if credLibs, err = fetchLibraries(ctx, reader, target.GetPublicId()); err != nil {
+			if credSources, err = fetchCredentialSources(ctx, reader, target.GetPublicId()); err != nil {
 				return errors.Wrap(err, op)
 			}
 			return nil
@@ -319,5 +319,5 @@ func (r *Repository) update(ctx context.Context, target Target, version uint32,
 	if err != nil {
 		return nil, nil, nil, db.NoRowsAffected, errors.Wrap(err, op)
 	}
-	return returnedTarget.(Target), hostSets, credLibs, rowsUpdated, nil
+	return returnedTarget.(Target), hostSets, credSources, rowsUpdated, nil
 }

internal/target/repository_credential_source.go

@@ -11,24 +11,24 @@ import (
 	"github.com/hashicorp/boundary/internal/oplog"
 )
 
-// AddTargetCredentialLibraries adds the clIds to the targetId in the repository. The target
-// and the list of credential libraries attached to the target, after clIds are added,
+// AddTargetCredentialSources adds the cIds to the targetId in the repository. The target
+// and the list of credential sources attached to the target, after cIds are added,
 // will be returned on success.
 // The targetVersion must match the current version of the targetId in the repository.
-func (r *Repository) AddTargetCredentialLibraries(ctx context.Context, targetId string, targetVersion uint32, clIds []string, _ ...Option) (Target, []*TargetSet, []*TargetLibrary, error) {
-	const op = "target.(Repository).AddTargetCredentialLibraries"
+func (r *Repository) AddTargetCredentialSources(ctx context.Context, targetId string, targetVersion uint32, cIds []string, _ ...Option) (Target, []*TargetSet, []CredentialSource, error) {
+	const op = "target.(Repository).AddTargetCredentialSources"
 	if targetId == "" {
 		return nil, nil, nil, errors.New(errors.InvalidParameter, op, "missing target id")
 	}
 	if targetVersion == 0 {
 		return nil, nil, nil, errors.New(errors.InvalidParameter, op, "missing version")
 	}
-	if len(clIds) == 0 {
-		return nil, nil, nil, errors.New(errors.InvalidParameter, op, "missing credential library ids")
+	if len(cIds) == 0 {
+		return nil, nil, nil, errors.New(errors.InvalidParameter, op, "missing credential source ids")
 	}
 
-	addCredLibs := make([]interface{}, 0, len(clIds))
-	for _, id := range clIds {
+	addCredLibs := make([]interface{}, 0, len(cIds))
+	for _, id := range cIds {
 		cl, err := NewCredentialLibrary(targetId, id)
 		if err != nil {
 			return nil, nil, nil, errors.Wrap(err, op, errors.WithMsg("unable to create in memory credential library"))
@@ -61,7 +61,7 @@ func (r *Repository) AddTargetCredentialLibraries(ctx context.Context, targetId
 	}
 
 	var hostSets []*TargetSet
-	var credLibs []*TargetLibrary
+	var credSources []CredentialSource
 	var updatedTarget interface{}
 	_, err = r.writer.DoTx(
 		ctx,
@@ -89,7 +89,7 @@ func (r *Repository) AddTargetCredentialLibraries(ctx context.Context, targetId
 
 			credLibsOplogMsgs := make([]*oplog.Message, 0, len(addCredLibs))
 			if err := w.CreateItems(ctx, addCredLibs, db.NewOplogMsgs(&credLibsOplogMsgs)); err != nil {
-				return errors.Wrap(err, op, errors.WithMsg("unable to create target credential libraries"))
+				return errors.Wrap(err, op, errors.WithMsg("unable to create target credential sources"))
 			}
 			msgs = append(msgs, credLibsOplogMsgs...)
 
@@ -98,11 +98,11 @@ func (r *Repository) AddTargetCredentialLibraries(ctx context.Context, targetId
 			}
 			hostSets, err = fetchSets(ctx, reader, targetId)
 			if err != nil {
-				return errors.Wrap(err, op, errors.WithMsg("unable to retrieve credential libraries after adding"))
+				return errors.Wrap(err, op, errors.WithMsg("unable to retrieve credential sources after adding"))
 			}
-			credLibs, err = fetchLibraries(ctx, reader, targetId)
+			credSources, err = fetchCredentialSources(ctx, reader, targetId)
 			if err != nil {
-				return errors.Wrap(err, op, errors.WithMsg("unable to retrieve credential libraries after adding"))
+				return errors.Wrap(err, op, errors.WithMsg("unable to retrieve credential sources after adding"))
 			}
 			return nil
 		},
@@ -110,25 +110,25 @@ func (r *Repository) AddTargetCredentialLibraries(ctx context.Context, targetId
 	if err != nil {
 		return nil, nil, nil, errors.Wrap(err, op)
 	}
-	return updatedTarget.(Target), hostSets, credLibs, nil
+	return updatedTarget.(Target), hostSets, credSources, nil
 }
 
-// DeleteTargetCredentialLibraries deletes credential libraries from a target in the repository.
+// DeleteTargetCredentialSources deletes credential sources from a target in the repository.
 // The target's current db version must match the targetVersion or an error will be returned.
-func (r *Repository) DeleteTargetCredentialLibraries(ctx context.Context, targetId string, targetVersion uint32, clIds []string, _ ...Option) (int, error) {
-	const op = "target.(Repository).DeleteTargetCredentialLibraries"
+func (r *Repository) DeleteTargetCredentialSources(ctx context.Context, targetId string, targetVersion uint32, csIds []string, _ ...Option) (int, error) {
+	const op = "target.(Repository).DeleteTargetCredentialSources"
 	if targetId == "" {
 		return db.NoRowsAffected, errors.New(errors.InvalidParameter, op, "missing target id")
 	}
 	if targetVersion == 0 {
 		return db.NoRowsAffected, errors.New(errors.InvalidParameter, op, "missing version")
 	}
-	if len(clIds) == 0 {
-		return db.NoRowsAffected, errors.New(errors.InvalidParameter, op, "missing credential library ids")
+	if len(csIds) == 0 {
+		return db.NoRowsAffected, errors.New(errors.InvalidParameter, op, "missing credential source ids")
 	}
 
-	deleteCredLibs := make([]interface{}, 0, len(clIds))
-	for _, id := range clIds {
+	deleteCredLibs := make([]interface{}, 0, len(csIds))
+	for _, id := range csIds {
 		cl, err := NewCredentialLibrary(targetId, id)
 		if err != nil {
 			return db.NoRowsAffected, errors.Wrap(err, op, errors.WithMsg("unable to create in memory credential library"))
@@ -188,10 +188,10 @@ func (r *Repository) DeleteTargetCredentialLibraries(ctx context.Context, target
 			credLibsOplogMsgs := make([]*oplog.Message, 0, len(deleteCredLibs))
 			rowsDeleted, err = w.DeleteItems(ctx, deleteCredLibs, db.NewOplogMsgs(&credLibsOplogMsgs))
 			if err != nil {
-				return errors.Wrap(err, op, errors.WithMsg("unable to delete target credential libraries"))
+				return errors.Wrap(err, op, errors.WithMsg("unable to delete target credential sources"))
 			}
 			if rowsDeleted != len(deleteCredLibs) {
-				return errors.New(errors.MultipleRecords, op, fmt.Sprintf("credential libraries deleted %d did not match request for %d", rowsDeleted, len(deleteCredLibs)))
+				return errors.New(errors.MultipleRecords, op, fmt.Sprintf("credential sources deleted %d did not match request for %d", rowsDeleted, len(deleteCredLibs)))
 			}
 			msgs = append(msgs, credLibsOplogMsgs...)
 
@@ -207,11 +207,11 @@ func (r *Repository) DeleteTargetCredentialLibraries(ctx context.Context, target
 	return rowsDeleted, nil
 }
 
-// SetTargetCredentialLibraries will set the target's credential libraries. Set will add
-// and/or delete credential libraries as need to reconcile the existing credential libraries
-// with the request. If clIds is empty, all the credential libraries will be cleared from the target.
-func (r *Repository) SetTargetCredentialLibraries(ctx context.Context, targetId string, targetVersion uint32, clIds []string, _ ...Option) ([]*TargetSet, []*TargetLibrary, int, error) {
-	const op = "target.(Repository).SetTargetCredentialLibraries"
+// SetTargetCredentialSources will set the target's credential sources. Set will add
+// and/or delete credential sources as need to reconcile the existing credential sources
+// with the request. If clIds is empty, all the credential sources will be cleared from the target.
+func (r *Repository) SetTargetCredentialSources(ctx context.Context, targetId string, targetVersion uint32, csIds []string, _ ...Option) ([]*TargetSet, []CredentialSource, int, error) {
+	const op = "target.(Repository).SetTargetCredentialSources"
 	if targetId == "" {
 		return nil, nil, db.NoRowsAffected, errors.New(errors.InvalidParameter, op, "missing target id")
 	}
@@ -219,7 +219,7 @@ func (r *Repository) SetTargetCredentialLibraries(ctx context.Context, targetId
 		return nil, nil, db.NoRowsAffected, errors.New(errors.InvalidParameter, op, "missing version")
 	}
 
-	changes, err := r.changes(ctx, targetId, clIds)
+	changes, err := r.changes(ctx, targetId, csIds)
 	if err != nil {
 		return nil, nil, db.NoRowsAffected, errors.Wrap(err, op)
 	}
@@ -229,11 +229,11 @@ func (r *Repository) SetTargetCredentialLibraries(ctx context.Context, targetId
 		if err != nil {
 			return nil, nil, db.NoRowsAffected, errors.Wrap(err, op)
 		}
-		credLibs, err := fetchLibraries(ctx, r.reader, targetId)
+		credSources, err := fetchCredentialSources(ctx, r.reader, targetId)
 		if err != nil {
 			return nil, nil, db.NoRowsAffected, errors.Wrap(err, op)
 		}
-		return hostSets, credLibs, db.NoRowsAffected, nil
+		return hostSets, credSources, db.NoRowsAffected, nil
 	}
 
 	var deleteCredLibs, addCredLibs []interface{}
@@ -274,7 +274,7 @@ func (r *Repository) SetTargetCredentialLibraries(ctx context.Context, targetId
 
 	var rowsAffected int
 	var hostSets []*TargetSet
-	var credLibs []*TargetLibrary
+	var credSources []CredentialSource
 	_, err = r.writer.DoTx(
 		ctx,
 		db.StdRetryCnt,
@@ -332,9 +332,9 @@ func (r *Repository) SetTargetCredentialLibraries(ctx context.Context, targetId
 			if err != nil {
 				return errors.Wrap(err, op, errors.WithMsg("unable to retrieve current target host sets after add/delete"))
 			}
-			credLibs, err = fetchLibraries(ctx, reader, targetId)
+			credSources, err = fetchCredentialSources(ctx, reader, targetId)
 			if err != nil {
-				return errors.Wrap(err, op, errors.WithMsg("unable to retrieve current target credential libraries after add/delete"))
+				return errors.Wrap(err, op, errors.WithMsg("unable to retrieve current target credential sources after add/delete"))
 			}
 			return nil
 		},
@@ -342,7 +342,7 @@ func (r *Repository) SetTargetCredentialLibraries(ctx context.Context, targetId
 	if err != nil {
 		return nil, nil, db.NoRowsAffected, errors.Wrap(err, op)
 	}
-	return hostSets, credLibs, rowsAffected, nil
+	return hostSets, credSources, rowsAffected, nil
 }
 
 type change struct {
@@ -385,14 +385,21 @@ func (r *Repository) changes(ctx context.Context, targetId string, clIds []strin
 	return changes, nil
 }
 
-func fetchLibraries(ctx context.Context, r db.Reader, targetId string) ([]*TargetLibrary, error) {
-	const op = "target.fetchLibraries"
+func fetchCredentialSources(ctx context.Context, r db.Reader, targetId string) ([]CredentialSource, error) {
+	const op = "target.fetchCredentialSources"
 	var libraries []*TargetLibrary
 	if err := r.SearchWhere(ctx, &libraries, "target_id = ?", []interface{}{targetId}); err != nil {
 		return nil, errors.Wrap(err, op)
 	}
+	// FIXME: When we have static creds, there will need to be an updated view
+	// that unions between libs and creds, at which point the type above will
+	// change. For now we just take the libraries and wrap them.
 	if len(libraries) == 0 {
 		return nil, nil
 	}
-	return libraries, nil
+	ret := make([]CredentialSource, len(libraries))
+	for i, lib := range libraries {
+		ret[i] = lib
+	}
+	return ret, nil
 }

internal/target/repository_credential_source_test.go

@@ -17,7 +17,7 @@ import (
 	"google.golang.org/protobuf/proto"
 )
 
-func TestRepository_AddTargetCredentialLibraries(t *testing.T) {
+func TestRepository_AddTargetCredentialSources(t *testing.T) {
 	t.Parallel()
 	conn, _ := db.TestSetup(t, "postgres")
 	rw := db.New(conn)
@@ -55,7 +55,7 @@ func TestRepository_AddTargetCredentialLibraries(t *testing.T) {
 			wantErrCode: errors.InvalidParameter,
 		},
 		{
-			name: "no-cred-libs",
+			name: "no-cred-sources",
 			args: args{
 				targetVersion: 1,
 			},
@@ -63,7 +63,7 @@ func TestRepository_AddTargetCredentialLibraries(t *testing.T) {
 			wantErrCode: errors.InvalidParameter,
 		},
 		{
-			name: "valid-single-lib",
+			name: "valid-single-source",
 			args: args{
 				targetVersion: 1,
 				credLibIds:    []string{lib1.PublicId},
@@ -72,7 +72,7 @@ func TestRepository_AddTargetCredentialLibraries(t *testing.T) {
 			wantErr:        false,
 		},
 		{
-			name: "valid-multiple-libs",
+			name: "valid-multiple-sources",
 			args: args{
 				targetVersion: 1,
 				credLibIds:    []string{lib1.PublicId, lib2.PublicId, lib3.PublicId},
@@ -81,10 +81,10 @@ func TestRepository_AddTargetCredentialLibraries(t *testing.T) {
 			wantErr:        false,
 		},
 		{
-			name: "invalid-lib-id",
+			name: "invalid-source-id",
 			args: args{
 				targetVersion: 1,
-				credLibIds:    []string{lib1.PublicId, lib2.PublicId, lib3.PublicId, "invalid-lib-id"},
+				credLibIds:    []string{lib1.PublicId, lib2.PublicId, lib3.PublicId, "invalid-source-id"},
 			},
 			wantErr:     true,
 			wantErrCode: errors.NotSpecificIntegrity,
@@ -104,78 +104,78 @@ func TestRepository_AddTargetCredentialLibraries(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
 
 			projTarget := TestTcpTarget(t, conn, staticProj.PublicId, tt.name)
-			gotTarget, _, gotCredLibs, err := repo.AddTargetCredentialLibraries(context.Background(), projTarget.PublicId, tt.args.targetVersion, tt.args.credLibIds)
+			gotTarget, _, gotCredSources, err := repo.AddTargetCredentialSources(context.Background(), projTarget.PublicId, tt.args.targetVersion, tt.args.credLibIds)
 			if tt.wantErr {
 				require.Error(err)
 				assert.Truef(errors.Match(errors.T(tt.wantErrCode), err), "unexpected error %s", err.Error())
 				return
 			}
 			require.NoError(err)
-			assert.Len(gotCredLibs, len(tt.wantCredLibIds))
-			gotCredLibsMap := map[string]*TargetLibrary{}
-			for _, s := range gotCredLibs {
-				gotCredLibsMap[s.CredentialLibraryId] = s
+			assert.Len(gotCredSources, len(tt.wantCredLibIds))
+			gotCredSourcesMap := map[string]CredentialSource{}
+			for _, s := range gotCredSources {
+				gotCredSourcesMap[s.Id()] = s
 			}
 			for _, id := range tt.wantCredLibIds {
-				assert.NotEmpty(gotCredLibsMap[id])
+				assert.NotEmpty(gotCredSourcesMap[id])
 			}
 
 			// test to see of the target version update oplog was created
 			err = db.TestVerifyOplog(t, rw, projTarget.PublicId, db.WithOperation(oplog.OpType_OP_TYPE_UPDATE), db.WithCreateNotBefore(10*time.Second))
 			assert.NoError(err)
 
-			foundCredLibs, err := fetchLibraries(context.Background(), rw, projTarget.PublicId)
+			foundCredSources, err := fetchCredentialSources(context.Background(), rw, projTarget.PublicId)
 			require.NoError(err)
-			assert.Len(foundCredLibs, len(gotCredLibsMap))
-			for _, s := range foundCredLibs {
-				assert.NotEmpty(gotCredLibsMap[s.CredentialLibraryId])
-				assert.Equal(projTarget.PublicId, s.TargetId)
+			assert.Len(foundCredSources, len(gotCredSourcesMap))
+			for _, s := range foundCredSources {
+				assert.NotEmpty(gotCredSourcesMap[s.Id()])
+				assert.Equal(projTarget.PublicId, s.TargetId())
 			}
 
-			target, _, lookupCredLibs, err := repo.LookupTarget(context.Background(), projTarget.PublicId)
+			target, _, lookupCredSources, err := repo.LookupTarget(context.Background(), projTarget.PublicId)
 			require.NoError(err)
 			assert.Equal(tt.args.targetVersion+1, target.GetVersion())
 			assert.Equal(projTarget.GetVersion(), target.GetVersion()-1)
 			assert.True(proto.Equal(gotTarget.(*TcpTarget), target.(*TcpTarget)))
-			assert.Equal(gotCredLibs, lookupCredLibs)
+			assert.Equal(gotCredSources, lookupCredSources)
 		})
 	}
 	t.Run("add-existing", func(t *testing.T) {
 		assert, require := assert.New(t), require.New(t)
 
 		projTarget := TestTcpTarget(t, conn, staticProj.PublicId, "add-existing")
-		_, _, gotCredLibs, err := repo.AddTargetCredentialLibraries(context.Background(), projTarget.PublicId, 1, []string{lib1.PublicId})
+		_, _, gotCredSources, err := repo.AddTargetCredentialSources(context.Background(), projTarget.PublicId, 1, []string{lib1.PublicId})
 		require.NoError(err)
-		assert.Len(gotCredLibs, 1)
-		assert.Equal(lib1.PublicId, gotCredLibs[0].CredentialLibraryId)
+		assert.Len(gotCredSources, 1)
+		assert.Equal(lib1.PublicId, gotCredSources[0].Id())
 
 		// Adding lib1 again should error
-		_, _, _, err = repo.AddTargetCredentialLibraries(context.Background(), projTarget.PublicId, 2, []string{lib1.PublicId})
+		_, _, _, err = repo.AddTargetCredentialSources(context.Background(), projTarget.PublicId, 2, []string{lib1.PublicId})
 		require.Error(err)
 		assert.True(errors.Match(errors.T(errors.NotUnique), err))
 
 		// Adding multiple with lib1 in set should error
-		_, _, _, err = repo.AddTargetCredentialLibraries(context.Background(), projTarget.PublicId, 2, []string{lib3.PublicId, lib2.PublicId, lib1.PublicId})
+		_, _, _, err = repo.AddTargetCredentialSources(context.Background(), projTarget.PublicId, 2, []string{lib3.PublicId, lib2.PublicId, lib1.PublicId})
 		require.Error(err)
 		assert.True(errors.Match(errors.T(errors.NotUnique), err))
 
 		// Previous transactions should have been rolled back and only lib1 should be associated
-		gotCredLibs, err = fetchLibraries(context.Background(), rw, projTarget.PublicId)
+		gotCredSources, err = fetchCredentialSources(context.Background(), rw, projTarget.PublicId)
 		require.NoError(err)
-		assert.Len(gotCredLibs, 1)
-		assert.Equal(lib1.PublicId, gotCredLibs[0].CredentialLibraryId)
+		assert.Len(gotCredSources, 1)
+		assert.Equal(lib1.PublicId, gotCredSources[0].Id())
 	})
 	t.Run("target-not-found", func(t *testing.T) {
 		assert, require := assert.New(t), require.New(t)
 
-		_, _, _, err := repo.AddTargetCredentialLibraries(context.Background(), "fake-target-id", 1, []string{lib1.PublicId})
+		_, _, _, err := repo.AddTargetCredentialSources(context.Background(), "fake-target-id", 1, []string{lib1.PublicId})
 
 		require.Error(err)
 		assert.Truef(errors.Match(errors.T(errors.RecordNotFound), err), "unexpected error %s", err.Error())
 	})
 }
 
-func TestRepository_DeleteTargetCredentialLibraries(t *testing.T) {
+func TestRepository_DeleteTargetCredentialSources(t *testing.T) {
 	t.Parallel()
 	conn, _ := db.TestSetup(t, "postgres")
 	rw := db.New(conn)
@@ -286,13 +286,13 @@ func TestRepository_DeleteTargetCredentialLibraries(t *testing.T) {
 					clIds = append(clIds, cl.PublicId)
 				}
 			}
-			_, _, addedCredLibs, err := repo.AddTargetCredentialLibraries(context.Background(), target.GetPublicId(), 1, clIds)
+			_, _, addedCredSources, err := repo.AddTargetCredentialSources(context.Background(), target.GetPublicId(), 1, clIds)
 			require.NoError(err)
-			assert.Equal(tt.args.createCnt, len(addedCredLibs))
+			assert.Equal(tt.args.createCnt, len(addedCredSources))
 
-			deleteCredLibs := make([]string, 0, tt.args.deleteCnt)
+			deleteCredSources := make([]string, 0, tt.args.deleteCnt)
 			for i := 0; i < tt.args.deleteCnt; i++ {
-				deleteCredLibs = append(deleteCredLibs, clIds[i])
+				deleteCredSources = append(deleteCredSources, clIds[i])
 			}
 			var targetId string
 			switch {
@@ -308,7 +308,7 @@ func TestRepository_DeleteTargetCredentialLibraries(t *testing.T) {
 			default:
 				targetVersion = 2
 			}
-			deletedRows, err := repo.DeleteTargetCredentialLibraries(context.Background(), targetId, targetVersion, deleteCredLibs)
+			deletedRows, err := repo.DeleteTargetCredentialSources(context.Background(), targetId, targetVersion, deleteCredSources)
 			if tt.wantErr {
 				require.Error(err)
 				assert.Equal(0, deletedRows)
@@ -335,30 +335,30 @@ func TestRepository_DeleteTargetCredentialLibraries(t *testing.T) {
 		lib3 := libs[2]
 
 		projTarget := TestTcpTarget(t, conn, proj.PublicId, "add-existing")
-		_, _, gotCredLibs, err := repo.AddTargetCredentialLibraries(context.Background(), projTarget.PublicId, 1, []string{lib1.PublicId, lib2.PublicId})
+		_, _, gotCredSources, err := repo.AddTargetCredentialSources(context.Background(), projTarget.PublicId, 1, []string{lib1.PublicId, lib2.PublicId})
 		require.NoError(err)
-		assert.Len(gotCredLibs, 2)
+		assert.Len(gotCredSources, 2)
 
-		// Deleting an unassociated library should return an error
-		delCount, err := repo.DeleteTargetCredentialLibraries(context.Background(), projTarget.PublicId, 2, []string{lib3.PublicId})
+		// Deleting an unassociated source should return an error
+		delCount, err := repo.DeleteTargetCredentialSources(context.Background(), projTarget.PublicId, 2, []string{lib3.PublicId})
 		require.Error(err)
 		assert.True(errors.Match(errors.T(errors.MultipleRecords), err))
 		assert.Equal(0, delCount)
 
-		// Deleting libraries which includes an unassociated libary should return an error
-		delCount, err = repo.DeleteTargetCredentialLibraries(context.Background(), projTarget.PublicId, 2, []string{lib1.PublicId, lib2.PublicId, lib3.PublicId})
+		// Deleting sources which includes an unassociated source should return an error
+		delCount, err = repo.DeleteTargetCredentialSources(context.Background(), projTarget.PublicId, 2, []string{lib1.PublicId, lib2.PublicId, lib3.PublicId})
 		require.Error(err)
 		assert.True(errors.Match(errors.T(errors.MultipleRecords), err))
 		assert.Equal(0, delCount)
 
 		// Previous transactions should have been rolled back and only lib1 should be associated
-		gotCredLibs, err = fetchLibraries(context.Background(), rw, projTarget.PublicId)
+		gotCredSources, err = fetchCredentialSources(context.Background(), rw, projTarget.PublicId)
 		require.NoError(err)
-		assert.Len(gotCredLibs, 2)
+		assert.Len(gotCredSources, 2)
 	})
 }
 
-func TestRepository_SetTargetCredentialLibraries(t *testing.T) {
+func TestRepository_SetTargetCredentialSources(t *testing.T) {
 	t.Parallel()
 	conn, _ := db.TestSetup(t, "postgres")
 	rw := db.New(conn)
@@ -375,14 +375,14 @@ func TestRepository_SetTargetCredentialLibraries(t *testing.T) {
 	lib1 := credLibs[0]
 	lib2 := credLibs[1]
 
-	setupFn := func(target Target) []*TargetLibrary {
+	setupFn := func(target Target) []CredentialSource {
 		credLibs := vault.TestCredentialLibraries(t, conn, wrapper, cs.GetPublicId(), 10)
 		clIds := make([]string, 0, len(credLibs))
 		for _, cl := range credLibs {
 			clIds = append(clIds, cl.PublicId)
 		}
 
-		_, _, created, err := repo.AddTargetCredentialLibraries(context.Background(), target.GetPublicId(), 1, clIds)
+		_, _, created, err := repo.AddTargetCredentialSources(context.Background(), target.GetPublicId(), 1, clIds)
 		require.NoError(t, err)
 		require.Equal(t, 10, len(created))
 		return created
@@ -394,7 +394,7 @@ func TestRepository_SetTargetCredentialLibraries(t *testing.T) {
 	}
 	tests := []struct {
 		name             string
-		setup            func(Target) []*TargetLibrary
+		setup            func(Target) []CredentialSource
 		args             args
 		wantAffectedRows int
 		wantErr          bool
@@ -422,7 +422,7 @@ func TestRepository_SetTargetCredentialLibraries(t *testing.T) {
 			wantAffectedRows: 0,
 		},
 		{
-			name:  "add-cred-libs",
+			name:  "add-cred-sources",
 			setup: setupFn,
 			args: args{
 				targetVersion: 2,
@@ -472,23 +472,23 @@ func TestRepository_SetTargetCredentialLibraries(t *testing.T) {
 
 			target := TestTcpTarget(t, conn, proj.PublicId, tt.name)
 
-			var origCredLibs []*TargetLibrary
+			var origCredSources []CredentialSource
 			if tt.setup != nil {
-				origCredLibs = tt.setup(target)
+				origCredSources = tt.setup(target)
 			}
 			if tt.args.addToOrigLibs {
-				origIds := make([]string, 0, len(origCredLibs))
-				for _, cl := range origCredLibs {
-					origIds = append(origIds, cl.CredentialLibraryId)
+				origIds := make([]string, 0, len(origCredSources))
+				for _, cl := range origCredSources {
+					origIds = append(origIds, cl.Id())
 				}
 				tt.args.clIds = append(tt.args.clIds, origIds...)
 			}
 
-			origTarget, _, lookupCredLibs, err := repo.LookupTarget(context.Background(), target.GetPublicId())
+			origTarget, _, lookupCredSources, err := repo.LookupTarget(context.Background(), target.GetPublicId())
 			require.NoError(err)
-			assert.Equal(origCredLibs, lookupCredLibs)
+			assert.Equal(origCredSources, lookupCredSources)
 
-			_, got, affectedRows, err := repo.SetTargetCredentialLibraries(context.Background(), target.GetPublicId(), tt.args.targetVersion, tt.args.clIds)
+			_, got, affectedRows, err := repo.SetTargetCredentialSources(context.Background(), target.GetPublicId(), tt.args.targetVersion, tt.args.clIds)
 			if tt.wantErr {
 				require.Error(err)
 				assert.Equal(0, affectedRows)
@@ -508,7 +508,7 @@ func TestRepository_SetTargetCredentialLibraries(t *testing.T) {
 			if len(got) > 0 {
 				gotIds = make([]string, 0, len(got))
 				for _, s := range got {
-					gotIds = append(gotIds, s.CredentialLibraryId)
+					gotIds = append(gotIds, s.Id())
 				}
 			}
 			sort.Strings(gotIds)
@@ -525,7 +525,7 @@ func TestRepository_SetTargetCredentialLibraries(t *testing.T) {
 	t.Run("missing-target-id", func(t *testing.T) {
 		assert, require := assert.New(t), require.New(t)
 
-		_, _, _, err := repo.SetTargetCredentialLibraries(context.Background(), "", 1, []string{lib1.PublicId})
+		_, _, _, err := repo.SetTargetCredentialSources(context.Background(), "", 1, []string{lib1.PublicId})
 
 		require.Error(err)
 		assert.Truef(errors.Match(errors.T(errors.InvalidParameter), err), "unexpected error %s", err.Error())
@@ -533,7 +533,7 @@ func TestRepository_SetTargetCredentialLibraries(t *testing.T) {
 	t.Run("target-not-found", func(t *testing.T) {
 		assert, require := assert.New(t), require.New(t)
 
-		_, _, _, err := repo.SetTargetCredentialLibraries(context.Background(), "fake-target-id", 1, []string{lib1.PublicId})
+		_, _, _, err := repo.SetTargetCredentialSources(context.Background(), "fake-target-id", 1, []string{lib1.PublicId})
 
 		require.Error(err)
 		assert.Truef(errors.Match(errors.T(errors.RecordNotFound), err), "unexpected error %s", err.Error())

internal/target/repository_host_set.go

@@ -15,7 +15,7 @@ import (
 // targetVersion or an error will be returned.   The target and a list of
 // current host set ids will be returned on success. Zero is not a valid value
 // for the WithVersion option and will return an error.
-func (r *Repository) AddTargetHostSets(ctx context.Context, targetId string, targetVersion uint32, hostSetIds []string, _ ...Option) (Target, []*TargetSet, []*TargetLibrary, error) {
+func (r *Repository) AddTargetHostSets(ctx context.Context, targetId string, targetVersion uint32, hostSetIds []string, _ ...Option) (Target, []*TargetSet, []CredentialSource, error) {
 	const op = "target.(Repository).AddTargetHostSets"
 	if targetId == "" {
 		return nil, nil, nil, errors.New(errors.InvalidParameter, op, "missing target id")
@@ -57,7 +57,7 @@ func (r *Repository) AddTargetHostSets(ctx context.Context, targetId string, tar
 		return nil, nil, nil, errors.Wrap(err, op, errors.WithMsg("unable to get oplog wrapper"))
 	}
 	var currentHostSets []*TargetSet
-	var currentCredLibs []*TargetLibrary
+	var currentCredSources []CredentialSource
 	var updatedTarget interface{}
 	_, err = r.writer.DoTx(
 		ctx,
@@ -93,9 +93,9 @@ func (r *Repository) AddTargetHostSets(ctx context.Context, targetId string, tar
 			if err != nil {
 				return errors.Wrap(err, op, errors.WithMsg("unable to retrieve current host sets after adds"))
 			}
-			currentCredLibs, err = fetchLibraries(ctx, reader, targetId)
+			currentCredSources, err = fetchCredentialSources(ctx, reader, targetId)
 			if err != nil {
-				return errors.Wrap(err, op, errors.WithMsg("unable to retrieve current credential libraries after adds"))
+				return errors.Wrap(err, op, errors.WithMsg("unable to retrieve current credential sources after adds"))
 			}
 			return nil
 		},
@@ -103,7 +103,7 @@ func (r *Repository) AddTargetHostSets(ctx context.Context, targetId string, tar
 	if err != nil {
 		return nil, nil, nil, errors.Wrap(err, op, errors.WithMsg("error creating sets"))
 	}
-	return updatedTarget.(Target), currentHostSets, currentCredLibs, nil
+	return updatedTarget.(Target), currentHostSets, currentCredSources, nil
 }
 
 // DeleteTargeHostSets deletes host sets from a target (targetId). The target's
@@ -203,7 +203,7 @@ func (r *Repository) DeleteTargeHostSets(ctx context.Context, targetId string, t
 // target host sets as need to reconcile the existing sets with the sets
 // requested. If hostSetIds is empty, the target host sets will be cleared. Zero
 // is not a valid value for the WithVersion option and will return an error.
-func (r *Repository) SetTargetHostSets(ctx context.Context, targetId string, targetVersion uint32, hostSetIds []string, _ ...Option) ([]*TargetSet, []*TargetLibrary, int, error) {
+func (r *Repository) SetTargetHostSets(ctx context.Context, targetId string, targetVersion uint32, hostSetIds []string, _ ...Option) ([]*TargetSet, []CredentialSource, int, error) {
 	const op = "target.(Repository).SetTargetHostSets"
 	if targetId == "" {
 		return nil, nil, db.NoRowsAffected, errors.New(errors.InvalidParameter, op, "missing target id")
@@ -278,7 +278,7 @@ func (r *Repository) SetTargetHostSets(ctx context.Context, targetId string, tar
 
 	var totalRowsAffected int
 	var currentHostSets []*TargetSet
-	var currentCredLibs []*TargetLibrary
+	var currentCredSources []CredentialSource
 	_, err = r.writer.DoTx(
 		ctx,
 		db.StdRetryCnt,
@@ -333,9 +333,9 @@ func (r *Repository) SetTargetHostSets(ctx context.Context, targetId string, tar
 			if err != nil {
 				return errors.Wrap(err, op, errors.WithMsg("unable to retrieve current target host sets after set"))
 			}
-			currentCredLibs, err = fetchLibraries(ctx, reader, targetId)
+			currentCredSources, err = fetchCredentialSources(ctx, reader, targetId)
 			if err != nil {
-				return errors.Wrap(err, op, errors.WithMsg("unable to retrieve current target credential libraries after set"))
+				return errors.Wrap(err, op, errors.WithMsg("unable to retrieve current target credential sources after set"))
 			}
 
 			return nil
@@ -344,7 +344,7 @@ func (r *Repository) SetTargetHostSets(ctx context.Context, targetId string, tar
 	if err != nil {
 		return nil, nil, db.NoRowsAffected, errors.Wrap(err, op)
 	}
-	return currentHostSets, currentCredLibs, totalRowsAffected, nil
+	return currentHostSets, currentCredSources, totalRowsAffected, nil
 }
 
 func fetchSets(ctx context.Context, r db.Reader, targetId string) ([]*TargetSet, error) {

internal/target/repository_tcp_target.go

@@ -14,8 +14,8 @@ import (
 
 // CreateTcpTarget inserts into the repository and returns the new Target with
 // its list of host sets and credential libraries.
-// WithHostSets and WithCredentialLibraries are the only supported option.
-func (r *Repository) CreateTcpTarget(ctx context.Context, target *TcpTarget, opt ...Option) (Target, []*TargetSet, []*TargetLibrary, error) {
+// WithHostSets and WithCredentialSources are the only supported option.
+func (r *Repository) CreateTcpTarget(ctx context.Context, target *TcpTarget, opt ...Option) (Target, []*TargetSet, []CredentialSource, error) {
 	const op = "target.(Repository).CreateTcpTarget"
 	opts := getOpts(opt...)
 	if target == nil {
@@ -63,8 +63,8 @@ func (r *Repository) CreateTcpTarget(ctx context.Context, target *TcpTarget, opt
 		newHostSets = append(newHostSets, hostSet)
 	}
 
-	newCredLibs := make([]interface{}, 0, len(opts.withCredentialLibraries))
-	for _, clId := range opts.withCredentialLibraries {
+	newCredLibs := make([]interface{}, 0, len(opts.withCredentialSources))
+	for _, clId := range opts.withCredentialSources {
 		credLib, err := NewCredentialLibrary(t.PublicId, clId)
 		if err != nil {
 			return nil, nil, nil, errors.Wrap(err, op, errors.WithMsg("unable to create in memory target credential library"))
@@ -75,7 +75,7 @@ func (r *Repository) CreateTcpTarget(ctx context.Context, target *TcpTarget, opt
 	metadata := t.oplog(oplog.OpType_OP_TYPE_CREATE)
 	var returnedTarget interface{}
 	var returnedHostSet []*TargetSet
-	var returnedCredLibs []*TargetLibrary
+	var returnedCredSources []CredentialSource
 	_, err = r.writer.DoTx(
 		ctx,
 		db.StdRetryCnt,
@@ -105,10 +105,10 @@ func (r *Repository) CreateTcpTarget(ctx context.Context, target *TcpTarget, opt
 			if len(newCredLibs) > 0 {
 				credLibOplogMsgs := make([]*oplog.Message, 0, len(newCredLibs))
 				if err := w.CreateItems(ctx, newCredLibs, db.NewOplogMsgs(&credLibOplogMsgs)); err != nil {
-					return errors.Wrap(err, op, errors.WithMsg("unable to add credential libraries"))
+					return errors.Wrap(err, op, errors.WithMsg("unable to add credential sources"))
 				}
-				if returnedCredLibs, err = fetchLibraries(ctx, read, t.PublicId); err != nil {
-					return errors.Wrap(err, op, errors.WithMsg("unable to read host sets"))
+				if returnedCredSources, err = fetchCredentialSources(ctx, read, t.PublicId); err != nil {
+					return errors.Wrap(err, op, errors.WithMsg("unable to read credential sources"))
 				}
 				msgs = append(msgs, credLibOplogMsgs...)
 			}
@@ -122,7 +122,7 @@ func (r *Repository) CreateTcpTarget(ctx context.Context, target *TcpTarget, opt
 	if err != nil {
 		return nil, nil, nil, errors.Wrap(err, op, errors.WithMsg(fmt.Sprintf("failed for %s target id", t.PublicId)))
 	}
-	return returnedTarget.(*TcpTarget), returnedHostSet, returnedCredLibs, nil
+	return returnedTarget.(*TcpTarget), returnedHostSet, returnedCredSources, nil
 }
 
 // UpdateTcpTarget will update a target in the repository and return the written
@@ -131,7 +131,7 @@ func (r *Repository) CreateTcpTarget(ctx context.Context, target *TcpTarget, opt
 // included in fieldMask. Name, Description, and WorkerFilter are the only
 // updatable fields. If no updatable fields are included in the fieldMaskPaths,
 // then an error is returned.
-func (r *Repository) UpdateTcpTarget(ctx context.Context, target *TcpTarget, version uint32, fieldMaskPaths []string, _ ...Option) (Target, []*TargetSet, []*TargetLibrary, int, error) {
+func (r *Repository) UpdateTcpTarget(ctx context.Context, target *TcpTarget, version uint32, fieldMaskPaths []string, _ ...Option) (Target, []*TargetSet, []CredentialSource, int, error) {
 	const op = "target.(Repository).UpdateTcpTarget"
 	if target == nil {
 		return nil, nil, nil, db.NoRowsAffected, errors.New(errors.InvalidParameter, op, "missing target")
@@ -173,7 +173,7 @@ func (r *Repository) UpdateTcpTarget(ctx context.Context, target *TcpTarget, ver
 	var returnedTarget Target
 	var rowsUpdated int
 	var targetSets []*TargetSet
-	var credLibs []*TargetLibrary
+	var credSources []CredentialSource
 	_, err := r.writer.DoTx(
 		ctx,
 		db.StdRetryCnt,
@@ -181,7 +181,7 @@ func (r *Repository) UpdateTcpTarget(ctx context.Context, target *TcpTarget, ver
 		func(read db.Reader, w db.Writer) error {
 			var err error
 			t := target.Clone().(*TcpTarget)
-			returnedTarget, targetSets, credLibs, rowsUpdated, err = r.update(ctx, t, version, dbMask, nullFields)
+			returnedTarget, targetSets, credSources, rowsUpdated, err = r.update(ctx, t, version, dbMask, nullFields)
 			if err != nil {
 				return errors.Wrap(err, op)
 			}
@@ -194,5 +194,5 @@ func (r *Repository) UpdateTcpTarget(ctx context.Context, target *TcpTarget, ver
 		}
 		return nil, nil, nil, db.NoRowsAffected, errors.Wrap(err, op, errors.WithMsg(fmt.Sprintf("failed for %s", target.PublicId)))
 	}
-	return returnedTarget.(Target), targetSets, credLibs, rowsUpdated, nil
+	return returnedTarget, targetSets, credSources, rowsUpdated, nil
 }

internal/target/repository_tcp_target_test.go

@@ -36,9 +36,9 @@ func TestRepository_CreateTcpTarget(t *testing.T) {
 	}
 
 	cs := vault.TestCredentialStores(t, conn, wrapper, proj.GetPublicId(), 1)[0]
-	credLibs := vault.TestCredentialLibraries(t, conn, wrapper, cs.GetPublicId(), 2)
+	credSources := vault.TestCredentialLibraries(t, conn, wrapper, cs.GetPublicId(), 2)
 	var clIds []string
-	for _, cl := range credLibs {
+	for _, cl := range credSources {
 		clIds = append(clIds, cl.PublicId)
 	}
 
@@ -98,7 +98,7 @@ func TestRepository_CreateTcpTarget(t *testing.T) {
 					require.NoError(t, err)
 					return target
 				}(),
-				opt: []Option{WithCredentialLibraries(clIds)},
+				opt: []Option{WithCredentialSources(clIds)},
 			},
 			wantErr:      false,
 			wantCredLibs: clIds,
@@ -117,7 +117,7 @@ func TestRepository_CreateTcpTarget(t *testing.T) {
 				}(),
 				opt: []Option{
 					WithHostSets(sets),
-					WithCredentialLibraries(clIds),
+					WithCredentialSources(clIds),
 				},
 			},
 			wantErr:      false,
@@ -175,7 +175,7 @@ func TestRepository_CreateTcpTarget(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			target, hostSets, credLibs, err := repo.CreateTcpTarget(context.Background(), tt.args.target, tt.args.opt...)
+			target, hostSets, credSources, err := repo.CreateTcpTarget(context.Background(), tt.args.target, tt.args.opt...)
 			if tt.wantErr {
 				assert.Error(err)
 				assert.Nil(target)
@@ -190,9 +190,9 @@ func TestRepository_CreateTcpTarget(t *testing.T) {
 			}
 			assert.Equal(tt.wantHostSets, hsIds)
 
-			clIds := make([]string, 0, len(credLibs))
-			for _, cl := range credLibs {
-				clIds = append(clIds, cl.CredentialLibraryId)
+			clIds := make([]string, 0, len(credSources))
+			for _, cl := range credSources {
+				clIds = append(clIds, cl.Id())
 			}
 			assert.Equal(tt.wantCredLibs, clIds)
 
@@ -200,7 +200,7 @@ func TestRepository_CreateTcpTarget(t *testing.T) {
 			assert.NoError(err)
 			assert.True(proto.Equal(target.(*TcpTarget), foundTarget.(*TcpTarget)))
 			assert.Equal(hostSets, foundHostSets)
-			assert.Equal(credLibs, foundCredLibs)
+			assert.Equal(credSources, foundCredLibs)
 
 			err = db.TestVerifyOplog(t, rw, target.GetPublicId(), db.WithOperation(oplog.OpType_OP_TYPE_CREATE), db.WithCreateNotBefore(10*time.Second))
 			assert.NoError(err)
@@ -439,7 +439,7 @@ func TestRepository_UpdateTcpTarget(t *testing.T) {
 				testClIds = append(testClIds, cl.PublicId)
 			}
 
-			tt.newTargetOpts = append(tt.newTargetOpts, WithHostSets(testHostSetIds), WithCredentialLibraries(testClIds))
+			tt.newTargetOpts = append(tt.newTargetOpts, WithHostSets(testHostSetIds), WithCredentialSources(testClIds))
 			name := tt.newName
 			if name == "" {
 				name = testId(t)
@@ -455,7 +455,7 @@ func TestRepository_UpdateTcpTarget(t *testing.T) {
 			updateTarget.Description = tt.args.description
 			updateTarget.DefaultPort = tt.args.port
 
-			targetAfterUpdate, hostSets, credLibs, updatedRows, err := repo.UpdateTcpTarget(context.Background(), &updateTarget, target.Version, tt.args.fieldMaskPaths, tt.args.opt...)
+			targetAfterUpdate, hostSets, credSources, updatedRows, err := repo.UpdateTcpTarget(context.Background(), &updateTarget, target.Version, tt.args.fieldMaskPaths, tt.args.opt...)
 			if tt.wantErr {
 				assert.Error(err)
 				assert.True(errors.Match(errors.T(tt.wantIsError), err))
@@ -476,9 +476,9 @@ func TestRepository_UpdateTcpTarget(t *testing.T) {
 			}
 			assert.Equal(testHostSetIds, afterUpdateIds)
 
-			afterUpdateIds = make([]string, 0, len(credLibs))
-			for _, cl := range credLibs {
-				afterUpdateIds = append(afterUpdateIds, cl.CredentialLibraryId)
+			afterUpdateIds = make([]string, 0, len(credSources))
+			for _, cl := range credSources {
+				afterUpdateIds = append(afterUpdateIds, cl.Id())
 			}
 			assert.Equal(testClIds, afterUpdateIds)
 

internal/target/testing.go

@@ -35,9 +35,9 @@ func TestTcpTarget(t *testing.T, conn *gorm.DB, scopeId, name string, opt ...Opt
 		err := rw.CreateItems(context.Background(), newHostSets)
 		require.NoError(err)
 	}
-	if len(opts.withCredentialLibraries) > 0 {
-		newCredLibs := make([]interface{}, 0, len(opts.withCredentialLibraries))
-		for _, cl := range opts.withCredentialLibraries {
+	if len(opts.withCredentialSources) > 0 {
+		newCredLibs := make([]interface{}, 0, len(opts.withCredentialSources))
+		for _, cl := range opts.withCredentialSources {
 			newCl, err := NewCredentialLibrary(target.PublicId, cl)
 			require.NoError(err)
 			newCredLibs = append(newCredLibs, newCl)

internal/target/testing_test.go

@@ -60,11 +60,11 @@ func Test_TestCredentialLibrary(t *testing.T) {
 	assert.Len(libs, 2)
 
 	rw := db.New(conn)
-	foundLibs, err := fetchLibraries(context.Background(), rw, target.PublicId)
+	foundSources, err := fetchCredentialSources(context.Background(), rw, target.PublicId)
 	require.NoError(err)
-	foundIds := make([]string, 0, len(foundLibs))
-	for _, s := range foundLibs {
-		foundIds = append(foundIds, s.CredentialLibraryId)
+	foundIds := make([]string, 0, len(foundSources))
+	for _, s := range foundSources {
+		foundIds = append(foundIds, s.Id())
 	}
 	require.Equal(libIds, foundIds)
 }

internal/types/action/action.go

@@ -44,9 +44,12 @@ const (
 	ChangeState               Type = 33
 	DeleteSelf                Type = 34
 	NoOp                      Type = 35
-	AddCredentialLibraries    Type = 36
-	SetCredentialLibraries    Type = 37
-	RemoveCredentialLibraries Type = 38
+	AddCredentialLibraries    Type = 36 // DEPRECATED
+	SetCredentialLibraries    Type = 37 // DEPRECATED
+	RemoveCredentialLibraries Type = 38 // DEPRECATED
+	AddCredentialSources      Type = 39
+	SetCredentialSources      Type = 40
+	RemoveCredentialSources   Type = 41
 )
 
 var Map = map[string]Type{
@@ -88,6 +91,9 @@ var Map = map[string]Type{
 	AddCredentialLibraries.String():    AddCredentialLibraries,
 	SetCredentialLibraries.String():    SetCredentialLibraries,
 	RemoveCredentialLibraries.String(): RemoveCredentialLibraries,
+	AddCredentialSources.String():      AddCredentialSources,
+	SetCredentialSources.String():      SetCredentialSources,
+	RemoveCredentialSources.String():   RemoveCredentialSources,
 }
 
 func (a Type) String() string {
@@ -131,6 +137,9 @@ func (a Type) String() string {
 		"add-credential-libraries",
 		"set-credential-libraries",
 		"remove-credential-libraries",
+		"add-credential-sources",
+		"set-credential-sources",
+		"remove-credential-sources",
 	}[a]
 }